# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: Jul 9 2019 16:03:52 # Log Creation Date: 19.07.2019 11:39:06.297 Process: id = "1" image_name = "search1.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\search1.exe" page_root = "0x4d1c5000" os_pid = "0xa8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\search1.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xa90 [0028.923] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76c20000 [0028.924] GetProcAddress (hModule=0x76c20000, lpProcName="WritePrivateProfileStringA") returned 0x76c57048 [0028.924] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0028.924] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0028.924] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0028.924] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0028.924] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileA") returned 0x76cad911 [0028.924] GetProcAddress (hModule=0x76c20000, lpProcName="LockResource") returned 0x76c35959 [0028.925] GetProcAddress (hModule=0x76c20000, lpProcName="LoadResource") returned 0x76c3594c [0028.925] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryA") returned 0x76c349d7 [0028.925] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0028.925] GetProcAddress (hModule=0x76c20000, lpProcName="GetPrivateProfileIntA") returned 0x76c5cdd7 [0028.925] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleA") returned 0x76c31245 [0028.925] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0028.925] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0028.925] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSize") returned 0x76c3196e [0028.925] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesA") returned 0x76c35414 [0028.925] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0028.925] GetProcAddress (hModule=0x76c20000, lpProcName="FreeResource") returned 0x76c4d3db [0028.925] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0028.925] GetProcAddress (hModule=0x76c20000, lpProcName="FormatMessageA") returned 0x76c55fbd [0028.926] GetProcAddress (hModule=0x76c20000, lpProcName="FindResourceA") returned 0x76c4e9bb [0028.926] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileA") returned 0x76c5d53e [0028.926] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileA") returned 0x76c3e2ce [0028.926] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0028.926] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileA") returned 0x76c35444 [0028.926] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0028.926] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0028.926] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76c20000 [0028.926] GetProcAddress (hModule=0x76c20000, lpProcName="TlsSetValue") returned 0x76c314fb [0028.926] GetProcAddress (hModule=0x76c20000, lpProcName="TlsGetValue") returned 0x76c311e0 [0028.926] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0028.926] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleA") returned 0x76c31245 [0028.926] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0028.926] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x76c20000 [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentThreadId") returned 0x76c31450 [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSection") returned 0x77162c42 [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualFree") returned 0x76c3186e [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="LocalFree") returned 0x76c32d3c [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="LocalAlloc") returned 0x76c3168c [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualQuery") returned 0x76c3445a [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcpyA") returned 0x76c52a9d [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="LoadLibraryExA") returned 0x76c34913 [0028.927] GetProcAddress (hModule=0x76c20000, lpProcName="GetThreadLocale") returned 0x76c335cf [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="GetStartupInfoA") returned 0x76c30e00 [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameA") returned 0x76c314b1 [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="GetLocaleInfoA") returned 0x76c4d5e5 [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineA") returned 0x76c351a1 [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="FreeLibrary") returned 0x76c334c8 [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointer") returned 0x76c317d1 [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="RtlUnwind") returned 0x76c5d1c3 [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="RaiseException") returned 0x76c358a6 [0028.928] GetProcAddress (hModule=0x76c20000, lpProcName="GetStdHandle") returned 0x76c351b3 [0028.929] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSize") returned 0x76c3196e [0028.929] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0028.929] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileType") returned 0x76c33531 [0028.929] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileA") returned 0x76c353c6 [0028.929] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0028.929] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0028.929] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExA") returned 0x74d548ef [0028.929] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExA") returned 0x74d54907 [0028.929] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0028.929] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0028.929] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExA") returned 0x74d514b3 [0028.929] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExA") returned 0x74d548ef [0028.929] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExA") returned 0x74d54907 [0028.929] GetProcAddress (hModule=0x74d40000, lpProcName="RegCreateKeyExA") returned 0x74d51469 [0028.930] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0028.930] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0028.930] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyKey") returned 0x74d4c51a [0028.930] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDestroyHash") returned 0x74d4df66 [0028.930] GetProcAddress (hModule=0x74d40000, lpProcName="CryptReleaseContext") returned 0x74d4e124 [0028.930] GetProcAddress (hModule=0x74d40000, lpProcName="CryptHashData") returned 0x74d4df36 [0028.930] GetProcAddress (hModule=0x74d40000, lpProcName="CryptCreateHash") returned 0x74d4df4e [0028.930] GetProcAddress (hModule=0x74d40000, lpProcName="CryptEncrypt") returned 0x74d6779b [0028.930] GetProcAddress (hModule=0x74d40000, lpProcName="CryptDeriveKey") returned 0x74d83188 [0028.930] GetProcAddress (hModule=0x74d40000, lpProcName="CryptAcquireContextA") returned 0x74d491dd [0028.930] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x74ae0000 [0028.930] GetProcAddress (hModule=0x74ae0000, lpProcName="InitCommonControls") returned 0x74ae1739 [0028.930] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ad0000 [0028.931] GetProcAddress (hModule=0x75ad0000, lpProcName="StretchDIBits") returned 0x75ae7435 [0028.931] GetProcAddress (hModule=0x75ad0000, lpProcName="SetWindowOrgEx") returned 0x75aeaf0a [0028.931] GetProcAddress (hModule=0x75ad0000, lpProcName="SetTextColor") returned 0x75ae522d [0028.931] GetProcAddress (hModule=0x75ad0000, lpProcName="SetROP2") returned 0x75aebc54 [0028.931] GetProcAddress (hModule=0x75ad0000, lpProcName="SetBrushOrgEx") returned 0x75ae9541 [0028.932] GetProcAddress (hModule=0x75ad0000, lpProcName="SetBkMode") returned 0x75ae51a2 [0028.932] GetProcAddress (hModule=0x75ad0000, lpProcName="SetBkColor") returned 0x75ae52d8 [0028.932] GetProcAddress (hModule=0x75ad0000, lpProcName="SelectObject") returned 0x75ae4f70 [0028.932] GetProcAddress (hModule=0x75ad0000, lpProcName="SelectClipRgn") returned 0x75ae8916 [0028.932] GetProcAddress (hModule=0x75ad0000, lpProcName="SaveDC") returned 0x75ae6e05 [0028.932] GetProcAddress (hModule=0x75ad0000, lpProcName="RestoreDC") returned 0x75ae6ead [0028.932] GetProcAddress (hModule=0x75ad0000, lpProcName="MoveToEx") returned 0x75ae8ee6 [0028.932] GetProcAddress (hModule=0x75ad0000, lpProcName="IntersectClipRect") returned 0x75ae7dc4 [0028.932] GetProcAddress (hModule=0x75ad0000, lpProcName="GetWindowOrgEx") returned 0x75aee310 [0028.932] GetProcAddress (hModule=0x75ad0000, lpProcName="GetStockObject") returned 0x75ae4eb8 [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="GetObjectA") returned 0x75ae85d4 [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="GetDeviceCaps") returned 0x75ae4de0 [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="ExcludeClipRect") returned 0x75aea066 [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteObject") returned 0x75ae5689 [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="DeleteDC") returned 0x75ae58b3 [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateSolidBrush") returned 0x75ae4f17 [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateRectRgnIndirect") returned 0x75aea764 [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateRectRgn") returned 0x75ae77cf [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateFontIndirectA") returned 0x75aecffd [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateDIBSection") returned 0x75aeac46 [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateCompatibleDC") returned 0x75ae54f4 [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="CreateCompatibleBitmap") returned 0x75ae5f49 [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="CombineRgn") returned 0x75aea903 [0028.933] GetProcAddress (hModule=0x75ad0000, lpProcName="BitBlt") returned 0x75ae5ea6 [0028.933] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75220000 [0028.934] GetProcAddress (hModule=0x75220000, lpProcName="VariantCopyInd") returned 0x7523e86c [0028.934] GetProcAddress (hModule=0x75220000, lpProcName="VariantClear") returned 0x75223eae [0028.934] GetProcAddress (hModule=0x75220000, lpProcName="SysFreeString") returned 0x75223e59 [0028.934] GetProcAddress (hModule=0x75220000, lpProcName="SysReAllocStringLen") returned 0x75227810 [0028.934] GetProcAddress (hModule=0x75220000, lpProcName="SysAllocStringLen") returned 0x752245d2 [0028.934] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x75fd0000 [0028.934] GetProcAddress (hModule=0x75fd0000, lpProcName="SHFileOperationA") returned 0x7622addd [0028.934] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0028.934] GetProcAddress (hModule=0x74f40000, lpProcName="WaitMessage") returned 0x74f7f5a9 [0028.934] GetProcAddress (hModule=0x74f40000, lpProcName="ValidateRect") returned 0x74f67849 [0028.934] GetProcAddress (hModule=0x74f40000, lpProcName="UpdateWindow") returned 0x74f63559 [0028.934] GetProcAddress (hModule=0x74f40000, lpProcName="TranslateMessage") returned 0x74f57809 [0028.934] GetProcAddress (hModule=0x74f40000, lpProcName="ShowWindow") returned 0x74f60dfb [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="SetWindowTextA") returned 0x74f67aee [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="SetWindowPos") returned 0x74f58e4e [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="SetWindowLongA") returned 0x74f66110 [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="SetPropA") returned 0x74f6822c [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="SetForegroundWindow") returned 0x74f7f170 [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="SetFocus") returned 0x74f62175 [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="SetCursor") returned 0x74f641f6 [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="SetCapture") returned 0x74f7ed56 [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="SendMessageA") returned 0x74f6612e [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="ScreenToClient") returned 0x74f6227d [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="RemovePropA") returned 0x74f68284 [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="ReleaseDC") returned 0x74f57446 [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="ReleaseCapture") returned 0x74f7ed49 [0028.935] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterWindowMessageA") returned 0x74f60afa [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="RegisterClassA") returned 0x74f6434b [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="PostQuitMessage") returned 0x74f59abb [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="PostMessageA") returned 0x74f63baa [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="PeekMessageA") returned 0x74f65f74 [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="OffsetRect") returned 0x74f60bbd [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="MoveWindow") returned 0x74f63698 [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxA") returned 0x74fafd1e [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="LoadIconA") returned 0x74f5dafb [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="LoadCursorA") returned 0x74f5dad5 [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="IsZoomed") returned 0x74f63332 [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindowVisible") returned 0x74f6112d [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindowEnabled") returned 0x74f62c1b [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="IsWindow") returned 0x74f57136 [0028.936] GetProcAddress (hModule=0x74f40000, lpProcName="IsIconic") returned 0x74f632a9 [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="InvalidateRgn") returned 0x74f66604 [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="InvalidateRect") returned 0x74f61381 [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="InflateRect") returned 0x74f63309 [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="GetWindowRect") returned 0x74f57f34 [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="GetWindowLongA") returned 0x74f5d156 [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="GetWindowDC") returned 0x74f58048 [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="GetUpdateRgn") returned 0x74f66222 [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="GetUpdateRect") returned 0x74f7d41f [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="GetSystemMenu") returned 0x74f66ea6 [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="GetSysColor") returned 0x74f56c3c [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="GetPropA") returned 0x74f67b5a [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="GetParent") returned 0x74f60f68 [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="GetWindow") returned 0x74f5926e [0028.937] GetProcAddress (hModule=0x74f40000, lpProcName="GetKeyState") returned 0x74f6291f [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="GetFocus") returned 0x74f60dee [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="GetDC") returned 0x74f572c4 [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="GetCursorPos") returned 0x74f61218 [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="GetClientRect") returned 0x74f60c62 [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="GetClassLongA") returned 0x74f686f9 [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="GetClassInfoA") returned 0x74f66ade [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="GetCapture") returned 0x74f62aac [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="GetAsyncKeyState") returned 0x74f7eb96 [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="FillRect") returned 0x74f60eb6 [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="EndPaint") returned 0x74f61341 [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="EnableWindow") returned 0x74f62da4 [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="EnableMenuItem") returned 0x74f66f50 [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="DispatchMessageA") returned 0x74f57bbb [0028.938] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyWindow") returned 0x74f59a55 [0028.939] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyIcon") returned 0x74f649b2 [0028.939] GetProcAddress (hModule=0x74f40000, lpProcName="DestroyAcceleratorTable") returned 0x74f63db6 [0028.939] GetProcAddress (hModule=0x74f40000, lpProcName="DeleteMenu") returned 0x74f66d2a [0028.939] GetProcAddress (hModule=0x74f40000, lpProcName="DefWindowProcA") returned 0x771724e0 [0028.939] GetProcAddress (hModule=0x74f40000, lpProcName="CreateWindowExA") returned 0x74f5d22e [0028.939] GetProcAddress (hModule=0x74f40000, lpProcName="CopyImage") returned 0x74f64a09 [0028.939] GetProcAddress (hModule=0x74f40000, lpProcName="ClientToScreen") returned 0x74f62606 [0028.939] GetProcAddress (hModule=0x74f40000, lpProcName="CallWindowProcA") returned 0x74f6792f [0028.939] GetProcAddress (hModule=0x74f40000, lpProcName="BeginPaint") returned 0x74f61361 [0028.939] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0028.939] GetProcAddress (hModule=0x74f40000, lpProcName="GetKeyboardType") returned 0x74f99ac4 [0028.939] GetProcAddress (hModule=0x74f40000, lpProcName="MessageBoxA") returned 0x74fafd1e [0028.939] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0028.943] VirtualProtect (in: lpAddress=0x400000, dwSize=0x1000, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0028.943] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0028.944] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18fe5c, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\search1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\search1.exe")) returned 0x31 [0028.944] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18fd37, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\search1.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\search1.exe")) returned 0x31 [0028.944] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18fe4c | out: phkResult=0x18fe4c*=0x0) returned 0x2 [0028.944] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18fe4c | out: phkResult=0x18fe4c*=0x0) returned 0x2 [0028.944] lstrcpyA (in: lpString1=0x18fd37, lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\search1.exe" | out: lpString1="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\search1.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\search1.exe" [0028.944] GetThreadLocale () returned 0x409 [0028.944] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x18fe47, cchData=5 | out: lpLCData="ENU") returned 4 [0028.945] lstrlenA (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\search1.exe") returned 49 [0028.945] lstrcpyA (in: lpString1=0x18fd65, lpString2="ENU" | out: lpString1="ENU") returned="ENU" [0028.945] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\search1.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0028.946] lstrcpyA (in: lpString1=0x18fd65, lpString2="EN" | out: lpString1="EN") returned="EN" [0028.946] LoadLibraryExA (lpLibFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\search1.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0028.946] GetKeyboardType (nTypeFlag=0) returned 4 [0028.946] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\search1.exe\" " [0028.946] GetStartupInfoA (in: lpStartupInfo=0x18fef0 | out: lpStartupInfo=0x18fef0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\search1.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0028.946] GetCurrentThreadId () returned 0xa90 [0028.946] InitCommonControls () [0028.946] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x74ae0000 [0028.946] GetProcAddress (hModule=0x74ae0000, lpProcName="InitCommonControlsEx") returned 0x74ae6be6 [0028.946] InitCommonControlsEx (picce=0x18ff34) returned 1 [0028.949] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x5b5918 [0028.949] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x210000 [0028.949] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x5b6918 [0028.949] VirtualAlloc (lpAddress=0x210000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0028.949] RegisterClipboardFormatA (lpszFormat="inner message") returned 0xc142 [0028.950] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\search1.exe\" " [0028.950] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0028.950] GetClassInfoA (in: hInstance=0x400000, lpClassName="App", lpWndClass=0x18fe9c | out: lpWndClass=0x18fe9c) returned 0 [0028.950] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_App", lpWndClass=0x18fe04 | out: lpWndClass=0x18fe04) returned 0 [0028.950] RegisterClassA (lpWndClass=0x18fe9c) returned 0x1ac140 [0028.950] CreateWindowExA (dwExStyle=0x40000, lpClassName="obj_App", lpWindowName="\xcf", dwStyle=0x80ca0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x401c4 [0029.217] SetPropA (hWnd=0x401c4, lpString="SELF_", hData=0x210394) returned 1 [0029.217] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x81, wParam=0x0, lParam=0x18fa4c) returned 0x1 [0029.219] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.219] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x83, wParam=0x0, lParam=0x18fa38) returned 0x0 [0029.315] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.315] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x1, wParam=0x0, lParam=0x18fa4c) returned 0x0 [0029.315] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.315] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0029.315] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.315] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x3, wParam=0x0, lParam=0x190003) returned 0x0 [0029.315] SendMessageA (hWnd=0x401c4, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0029.315] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.315] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0029.315] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.316] LoadIconA (hInstance=0x400000, lpIconName="MAINICON") returned 0x0 [0029.317] SendMessageA (hWnd=0x401c4, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0029.317] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.317] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0029.334] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.334] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0029.335] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.335] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0029.335] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.335] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0029.341] GetSystemMenu (hWnd=0x401c4, bRevert=0) returned 0x20203 [0029.345] EnableMenuItem (hMenu=0x20203, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0029.345] DeleteMenu (hMenu=0x20203, uPosition=0xf000, uFlags=0x0) returned 1 [0029.345] DeleteMenu (hMenu=0x20203, uPosition=0xf010, uFlags=0x0) returned 1 [0029.345] DeleteMenu (hMenu=0x20203, uPosition=0xf030, uFlags=0x0) returned 1 [0029.345] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0029.346] GetClassInfoA (in: hInstance=0x400000, lpClassName="Form", lpWndClass=0x18fe18 | out: lpWndClass=0x18fe18) returned 0 [0029.346] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_Form", lpWndClass=0x18fd80 | out: lpWndClass=0x18fd80) returned 0 [0029.346] RegisterClassA (lpWndClass=0x18fe18) returned 0xc138 [0029.346] CreateWindowExA (dwExStyle=0x10000, lpClassName="obj_Form", lpWindowName="\xcf", dwStyle=0x6cf0000, X=-2147483648, Y=-2147483648, nWidth=64, nHeight=64, hWndParent=0x401c4, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x301c0 [0029.346] SetPropA (hWnd=0x301c0, lpString="SELF_", hData=0x2109e4) returned 1 [0029.346] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x24, wParam=0x0, lParam=0x18f9d4) returned 0x0 [0029.346] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.346] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x81, wParam=0x0, lParam=0x18f9c8) returned 0x1 [0029.346] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.346] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x83, wParam=0x0, lParam=0x18f9b4) returned 0x0 [0029.347] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.347] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x1, wParam=0x0, lParam=0x18f9c8) returned 0x0 [0029.347] SendMessageA (hWnd=0x301c0, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0029.347] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.347] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0029.347] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.347] LoadIconA (hInstance=0x400000, lpIconName="MAINICON") returned 0x0 [0029.347] SendMessageA (hWnd=0x301c0, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0029.347] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.347] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0029.348] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.348] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0029.348] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.348] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0029.348] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.348] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0029.349] LoadIconA (hInstance=0x400000, lpIconName="ASMA") returned 0x201c5 [0029.349] SendMessageA (hWnd=0x401c4, Msg=0x80, wParam=0x1, lParam=0x201c5) returned 0x0 [0029.349] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.350] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x80, wParam=0x1, lParam=0x201c5) returned 0x0 [0029.350] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.350] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x201c3 [0029.351] SendMessageA (hWnd=0x301c0, Msg=0x80, wParam=0x1, lParam=0x201c5) returned 0x0 [0029.351] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.351] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x80, wParam=0x1, lParam=0x201c5) returned 0x0 [0029.351] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.351] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x201c1 [0029.352] InvalidateRect (hWnd=0x301c0, lpRect=0x0, bErase=1) returned 1 [0029.352] GetWindowRect (in: hWnd=0x301c0, lpRect=0x18febc | out: lpRect=0x18febc) returned 1 [0029.352] GetWindowRect (in: hWnd=0x301c0, lpRect=0x18fea0 | out: lpRect=0x18fea0) returned 1 [0029.352] SetWindowPos (hWnd=0x301c0, hWndInsertAfter=0x0, X=0, Y=175, cx=132, cy=64, uFlags=0x14) returned 1 [0029.352] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.352] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x46, wParam=0x0, lParam=0x18fe4c) returned 0x0 [0029.352] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.352] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x24, wParam=0x0, lParam=0x18fb74) returned 0x0 [0029.353] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.353] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x47, wParam=0x0, lParam=0x18fe4c) returned 0x0 [0029.353] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.353] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x3, wParam=0x0, lParam=0xcd0008) returned 0x0 [0029.354] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.354] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x83, wParam=0x1, lParam=0x18fa30) returned 0x0 [0029.354] GetWindowRect (in: hWnd=0x301c0, lpRect=0x18feb8 | out: lpRect=0x18feb8) returned 1 [0029.354] GetWindowRect (in: hWnd=0x301c0, lpRect=0x18fea0 | out: lpRect=0x18fea0) returned 1 [0029.354] SetWindowPos (hWnd=0x301c0, hWndInsertAfter=0x0, X=0, Y=0, cx=132, cy=64, uFlags=0x14) returned 1 [0029.354] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.354] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x46, wParam=0x0, lParam=0x18fe4c) returned 0x0 [0029.354] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.354] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x24, wParam=0x0, lParam=0x18fb74) returned 0x0 [0029.355] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.355] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x47, wParam=0x0, lParam=0x18fe4c) returned 0x0 [0029.355] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.355] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x3, wParam=0x0, lParam=0x1e0008) returned 0x0 [0029.355] GetWindowRect (in: hWnd=0x301c0, lpRect=0x18fecc | out: lpRect=0x18fecc) returned 1 [0029.355] GetWindowRect (in: hWnd=0x301c0, lpRect=0x18feb0 | out: lpRect=0x18feb0) returned 1 [0029.355] SetWindowPos (hWnd=0x301c0, hWndInsertAfter=0x0, X=0, Y=0, cx=593, cy=505, uFlags=0x14) returned 1 [0029.355] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.355] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x46, wParam=0x0, lParam=0x18fe5c) returned 0x0 [0029.355] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.355] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x24, wParam=0x0, lParam=0x18fb84) returned 0x0 [0029.355] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.355] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x83, wParam=0x1, lParam=0x18fe34) returned 0x0 [0029.356] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.356] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x47, wParam=0x0, lParam=0x18fe5c) returned 0x0 [0029.356] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.356] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x5, wParam=0x0, lParam=0x1d30241) returned 0x0 [0029.356] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.356] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x83, wParam=0x1, lParam=0x18fa40) returned 0x0 [0029.357] GetWindowLongA (hWnd=0x301c0, nIndex=-16) returned 114229248 [0029.357] GetWindowLongA (hWnd=0x301c0, nIndex=-20) returned 65792 [0029.357] GetClassLongA (hWnd=0x301c0, nIndex=-26) returned 0x8 [0029.357] IsWindowEnabled (hWnd=0x301c0) returned 1 [0029.357] LoadCursorA (hInstance=0x0, lpCursorName=0x0) returned 0x0 [0029.357] CreateFontIndirectA (lplf=0x211119) returned 0x170a0274 [0029.357] SendMessageA (hWnd=0x301c0, Msg=0x30, wParam=0x170a0274, lParam=0xffff) returned 0x0 [0029.357] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.357] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x30, wParam=0x170a0274, lParam=0xffff) returned 0x0 [0029.357] InvalidateRect (hWnd=0x301c0, lpRect=0x0, bErase=1) returned 1 [0029.357] GetDC (hWnd=0x0) returned 0x4010842 [0029.357] GetDeviceCaps (hdc=0x4010842, index=90) returned 96 [0029.357] ReleaseDC (hWnd=0x0, hDC=0x4010842) returned 1 [0029.357] CreateFontIndirectA (lplf=0x211119) returned 0x30a0886 [0029.357] SendMessageA (hWnd=0x301c0, Msg=0x30, wParam=0x30a0886, lParam=0xffff) returned 0x0 [0029.357] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.358] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x30, wParam=0x30a0886, lParam=0xffff) returned 0x0 [0029.358] InvalidateRect (hWnd=0x301c0, lpRect=0x0, bErase=1) returned 1 [0029.358] DeleteObject (ho=0x170a0274) returned 1 [0029.358] SendMessageA (hWnd=0x301c0, Msg=0x30, wParam=0x30a0886, lParam=0xffff) returned 0x0 [0029.358] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.358] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x30, wParam=0x30a0886, lParam=0xffff) returned 0x0 [0029.358] InvalidateRect (hWnd=0x301c0, lpRect=0x0, bErase=1) returned 1 [0029.358] SetWindowPos (hWnd=0x301c0, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x293) returned 1 [0029.358] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.358] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x46, wParam=0x0, lParam=0x18fe98) returned 0x0 [0029.358] ShowWindow (hWnd=0x301c0, nCmdShow=0) returned 0 [0029.358] GetClientRect (in: hWnd=0x401c4, lpRect=0x18feb8 | out: lpRect=0x18feb8) returned 1 [0029.358] LoadCursorA (hInstance=0x0, lpCursorName=0x0) returned 0x0 [0029.358] GetClientRect (in: hWnd=0x301c0, lpRect=0x18fe9c | out: lpRect=0x18fe9c) returned 1 [0029.358] IsWindowVisible (hWnd=0x301c0) returned 0 [0029.358] IsWindowVisible (hWnd=0x301c0) returned 0 [0029.358] IsWindowVisible (hWnd=0x301c0) returned 0 [0029.358] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0029.358] GetClassInfoA (in: hInstance=0x400000, lpClassName="BUTTON", lpWndClass=0x18fe8c | out: lpWndClass=0x18fe8c) returned 1 [0029.358] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_BUTTON", lpWndClass=0x18fdf4 | out: lpWndClass=0x18fdf4) returned 0 [0029.358] RegisterClassA (lpWndClass=0x18fe8c) returned 0xc13a [0029.358] CreateWindowExA (dwExStyle=0x10000, lpClassName="obj_BUTTON", lpWindowName="Push", dwStyle=0x46013000, X=315, Y=440, nWidth=55, nHeight=20, hWndParent=0x301c0, hMenu=0x8000, hInstance=0x400000, lpParam=0x0) returned 0x401bc [0029.359] SetPropA (hWnd=0x401bc, lpString="SELF_", hData=0x211434) returned 1 [0029.359] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x81, wParam=0x0, lParam=0x18fa3c) returned 0x1 [0029.359] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0029.359] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x83, wParam=0x0, lParam=0x18fa28) returned 0x0 [0029.359] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0029.359] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x1, wParam=0x0, lParam=0x18fa3c) returned 0x0 [0029.359] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0029.359] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x5, wParam=0x0, lParam=0x140037) returned 0x0 [0029.359] GetClientRect (in: hWnd=0x301c0, lpRect=0x18f8ac | out: lpRect=0x18f8ac) returned 1 [0029.359] IsWindowVisible (hWnd=0x301c0) returned 0 [0029.359] IsWindowVisible (hWnd=0x301c0) returned 0 [0029.359] IsWindowVisible (hWnd=0x301c0) returned 0 [0029.359] GetClientRect (in: hWnd=0x401bc, lpRect=0x18f8ac | out: lpRect=0x18f8ac) returned 1 [0029.359] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0029.359] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x3, wParam=0x0, lParam=0x1b8013b) returned 0x0 [0029.359] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.359] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x210, wParam=0x80000001, lParam=0x401bc) returned 0x0 [0029.359] SendMessageA (hWnd=0x401bc, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0029.360] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0029.360] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0029.360] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0029.360] SendMessageA (hWnd=0x401bc, Msg=0x30, wParam=0x30a0886, lParam=0xffff) returned 0x0 [0029.360] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0029.360] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x30, wParam=0x30a0886, lParam=0xffff) returned 0x0 [0029.360] SendMessageA (hWnd=0x401bc, Msg=0x30, wParam=0x30a0886, lParam=0xffff) returned 0x0 [0029.360] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0029.360] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x30, wParam=0x30a0886, lParam=0xffff) returned 0x0 [0029.360] SetWindowPos (hWnd=0x401bc, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x293) returned 1 [0029.360] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0029.360] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x46, wParam=0x0, lParam=0x18fe98) returned 0x0 [0029.360] ShowWindow (hWnd=0x401bc, nCmdShow=5) returned 0 [0029.360] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0029.360] IsWindowVisible (hWnd=0x401bc) returned 0 [0029.360] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0029.360] GetClientRect (in: hWnd=0x301c0, lpRect=0x18feb8 | out: lpRect=0x18feb8) returned 1 [0029.360] IsWindowVisible (hWnd=0x301c0) returned 0 [0029.360] IsWindowVisible (hWnd=0x301c0) returned 0 [0029.360] IsWindowVisible (hWnd=0x301c0) returned 0 [0029.360] GetClientRect (in: hWnd=0x401bc, lpRect=0x18feb8 | out: lpRect=0x18feb8) returned 1 [0029.360] ShowWindow (hWnd=0x401bc, nCmdShow=5) returned 1 [0029.361] GetClientRect (in: hWnd=0x301c0, lpRect=0x18feb4 | out: lpRect=0x18feb4) returned 1 [0029.361] IsWindowVisible (hWnd=0x301c0) returned 0 [0029.361] IsWindowVisible (hWnd=0x301c0) returned 0 [0029.361] IsWindowVisible (hWnd=0x301c0) returned 0 [0029.361] GetClientRect (in: hWnd=0x401bc, lpRect=0x18feb4 | out: lpRect=0x18feb4) returned 1 [0029.361] FindResourceA (hModule=0x400000, lpName="Str1", lpType=0x64) returned 0x4271b0 [0029.361] LoadResource (hModule=0x400000, hResInfo=0x4271b0) returned 0x423f9c [0029.361] LockResource (hResData=0x423f9c) returned 0x423f9c [0029.361] FreeResource (hResData=0x423f9c) returned 0 [0029.361] ShowWindow (hWnd=0x401c4, nCmdShow=5) returned 0 [0029.361] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.361] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0029.361] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.361] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x46, wParam=0x0, lParam=0x18ff20) returned 0x0 [0029.361] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.361] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x46, wParam=0x0, lParam=0x18ff20) returned 0x0 [0029.365] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.365] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x46, wParam=0x0, lParam=0x18ff20) returned 0x0 [0029.366] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.366] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x46, wParam=0x0, lParam=0x18ff20) returned 0x0 [0029.366] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0029.366] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0029.366] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.366] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0029.366] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.366] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0029.366] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.366] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0029.388] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.388] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0029.390] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.390] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0029.390] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.390] IsWindowEnabled (hWnd=0x401c4) returned 1 [0029.390] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0029.390] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x47, wParam=0x0, lParam=0x18ff20) returned 0x0 [0029.390] GetClientRect (in: hWnd=0x401c4, lpRect=0x18ff3c | out: lpRect=0x18ff3c) returned 1 [0029.390] GetSystemTime (in: lpSystemTime=0x18fe7c | out: lpSystemTime=0x18fe7c*(wYear=0x7e3, wMonth=0x7, wDayOfWeek=0x5, wDay=0x13, wHour=0xb, wMinute=0x27, wSecond=0x20, wMilliseconds=0x26e)) [0029.390] FindFirstFileA (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x3, cFileName=".", cAlternateFileName="")) returned 0x5c3c68 [0029.391] FindNextFileA (in: hFindFile=0x5c3c68, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x3, cFileName="..", cAlternateFileName="")) returned 1 [0029.391] FindNextFileA (in: hFindFile=0x5c3c68, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x3, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0029.391] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f834, dwReserved1=0x20b87e0, cFileName=".", cAlternateFileName="")) returned 0x5c4cb0 [0029.391] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f834, dwReserved1=0x20b87e0, cFileName="..", cAlternateFileName="")) returned 1 [0029.391] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f834, dwReserved1=0x20b87e0, cFileName="AppData", cAlternateFileName="")) returned 1 [0029.391] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f5f4, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x5c5d58 [0029.391] FindNextFileA (in: hFindFile=0x5c5d58, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f5f4, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0029.391] FindNextFileA (in: hFindFile=0x5c5d58, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f5f4, dwReserved1=0x77163c74, cFileName="Local", cAlternateFileName="")) returned 1 [0029.391] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c5fe8, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c5cf8 [0029.391] FindNextFileA (in: hFindFile=0x5c5cf8, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c5fe8, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0029.391] FindNextFileA (in: hFindFile=0x5c5cf8, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c5fe8, dwReserved1=0x5a0000, cFileName="Adobe", cAlternateFileName="")) returned 1 [0029.391] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f124, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x5c7e20 [0029.392] FindNextFileA (in: hFindFile=0x5c7e20, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f124, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0029.392] FindNextFileA (in: hFindFile=0x5c7e20, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f124, dwReserved1=0x77163c74, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0029.392] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eebc, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x5c7da8 [0029.392] FindNextFileA (in: hFindFile=0x5c7da8, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eebc, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0029.392] FindNextFileA (in: hFindFile=0x5c7da8, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eebc, dwReserved1=0x77163c74, cFileName="10.0", cAlternateFileName="")) returned 1 [0029.392] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec54, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x5c9f00 [0029.393] FindNextFileA (in: hFindFile=0x5c9f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec54, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0029.393] FindNextFileA (in: hFindFile=0x5c9f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x18ec54, dwReserved1=0x77163c74, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0029.393] FindNextFileA (in: hFindFile=0x5c9f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x18ec54, dwReserved1=0x77163c74, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0029.393] FindNextFileA (in: hFindFile=0x5c9f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18ec54, dwReserved1=0x77163c74, cFileName="Cache", cAlternateFileName="")) returned 1 [0029.393] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9ec, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x5c9e70 [0029.397] FindNextFileA (in: hFindFile=0x5c9e70, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e9ec, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0029.397] FindNextFileA (in: hFindFile=0x5c9e70, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x18e9ec, dwReserved1=0x77163c74, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0029.397] FindNextFileA (in: hFindFile=0x5c9e70, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x18e9ec, dwReserved1=0x77163c74, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0029.397] FindClose (in: hFindFile=0x5c9e70 | out: hFindFile=0x5c9e70) returned 1 [0029.397] FindNextFileA (in: hFindFile=0x5c9f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x187473, dwReserved1=0x77163c74, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0029.397] FindNextFileA (in: hFindFile=0x5c9f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x187473, dwReserved1=0x77163c74, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0029.397] FindNextFileA (in: hFindFile=0x5c9f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x187473, dwReserved1=0x77163c74, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0029.397] FindClose (in: hFindFile=0x5c9f00 | out: hFindFile=0x5c9f00) returned 1 [0029.397] FindNextFileA (in: hFindFile=0x5c7da8, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eebc, dwReserved1=0x77163c74, cFileName="10.0", cAlternateFileName="")) returned 0 [0029.397] FindClose (in: hFindFile=0x5c7da8 | out: hFindFile=0x5c7da8) returned 1 [0029.397] FindNextFileA (in: hFindFile=0x5c7e20, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f124, dwReserved1=0x77163c74, cFileName="Color", cAlternateFileName="")) returned 1 [0029.397] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0029.397] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName="..", cAlternateFileName="")) returned 1 [0029.397] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0029.397] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName="Profiles", cAlternateFileName="")) returned 1 [0029.397] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x187473, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0029.398] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x187473, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0029.398] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x187473, dwReserved1=0x77163c74, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0029.398] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x187473, dwReserved1=0x77163c74, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0029.398] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x187473, dwReserved1=0x77163c74, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0 [0029.398] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0029.398] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName="Profiles", cAlternateFileName="")) returned 0 [0029.398] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0029.398] FindNextFileA (in: hFindFile=0x5c7e20, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f124, dwReserved1=0x77163c74, cFileName="Color", cAlternateFileName="")) returned 0 [0029.398] FindClose (in: hFindFile=0x5c7e20 | out: hFindFile=0x5c7e20) returned 1 [0029.399] FindNextFileA (in: hFindFile=0x5c5cf8, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x5a0000, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0029.399] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f124, dwReserved1=0x77163c74, cFileName="Color", cAlternateFileName="\xf8\x5c\x5c")) returned 0xffffffff [0029.400] FindNextFileA (in: hFindFile=0x5c5cf8, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x5a0000, cFileName="Apps", cAlternateFileName="")) returned 1 [0029.400] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74736c, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0029.400] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74736c, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0029.400] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74736c, dwReserved1=0x77163c74, cFileName="2.0", cAlternateFileName="")) returned 1 [0029.400] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0029.400] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName="..", cAlternateFileName="")) returned 1 [0029.400] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e69, dwReserved1=0x77747473, cFileName="Data", cAlternateFileName="")) returned 1 [0029.400] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0029.401] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.401] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1 [0029.401] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.404] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.404] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1 [0029.404] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.404] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.404] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0029.404] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0029.405] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.405] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0029.405] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0029.405] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.405] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.405] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0029.406] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0029.406] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0029.406] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0 [0029.406] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.406] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0 [0029.406] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.406] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0 [0029.406] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0029.406] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e37, dwReserved1=0x77747473, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1 [0029.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0029.406] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.406] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1 [0029.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38616162, dwReserved1=0x61333130, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.408] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38616162, dwReserved1=0x61333130, cFileName="..", cAlternateFileName="")) returned 1 [0029.408] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38616162, dwReserved1=0x61333130, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1 [0029.408] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.408] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.408] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0029.408] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 0 [0029.408] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.409] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74655365, dwReserved1=0x652e7075, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0029.409] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.410] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.410] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 1 [0029.410] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.cdf-ms", cAlternateFileName="")) returned 1 [0029.411] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.manifest", cAlternateFileName="")) returned 1 [0029.411] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap_unsigned.cdf-ms", cAlternateFileName="CLICKO~1.CDF")) returned 1 [0029.411] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap_unsigned.manifest", cAlternateFileName="CLICKO~1.MAN")) returned 1 [0029.411] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 1 [0029.411] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 0 [0029.411] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.411] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74655365, dwReserved1=0x652e7075, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1 [0029.411] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.413] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.413] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 1 [0029.413] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cAlternateFileName="CLICEX~1.MAN")) returned 1 [0029.413] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", cAlternateFileName="GOOGAP~1.CDF")) returned 1 [0029.413] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 1 [0029.413] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 0 [0029.413] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.414] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74655365, dwReserved1=0x652e7075, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0 [0029.414] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.414] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0 [0029.414] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0029.414] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e37, dwReserved1=0x77747473, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 0 [0029.414] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0029.414] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74736c, dwReserved1=0x77163c74, cFileName="2.0", cAlternateFileName="")) returned 0 [0029.414] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0029.414] FindNextFileA (in: hFindFile=0x5c5cf8, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x5a0000, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0029.414] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0029.415] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0029.415] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 0 [0029.415] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0029.416] FindNextFileA (in: hFindFile=0x5c5cf8, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x5a0000, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1 [0029.416] FindNextFileA (in: hFindFile=0x5c5cf8, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x5a0000, cFileName="Google", cAlternateFileName="")) returned 1 [0029.416] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0029.416] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x77163c74, cFileName="..", cAlternateFileName="")) returned 1 [0029.416] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x77163c74, cFileName="Chrome", cAlternateFileName="")) returned 1 [0029.416] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e54, dwReserved1=0x77747473, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0029.416] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e54, dwReserved1=0x77747473, cFileName="..", cAlternateFileName="")) returned 1 [0029.416] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x746e6e54, dwReserved1=0x77747473, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0029.416] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0029.418] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.419] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0029.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.419] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.419] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.420] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.420] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0029.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.420] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.420] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata", cAlternateFileName="")) returned 1 [0029.420] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="reports", cAlternateFileName="")) returned 1 [0029.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.421] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.421] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.421] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.421] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0029.421] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0029.421] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.421] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0029.421] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.422] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.423] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0029.423] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.424] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.424] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_0", cAlternateFileName="")) returned 1 [0029.424] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_1", cAlternateFileName="")) returned 1 [0029.424] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_2", cAlternateFileName="")) returned 1 [0029.424] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x402000, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_3", cAlternateFileName="")) returned 1 [0029.424] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 1 [0029.424] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x0, cFileName="index", cAlternateFileName="")) returned 0 [0029.424] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.424] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0029.424] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d44890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 1 [0029.424] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83b08a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83b08a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0b57b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Current Session", cAlternateFileName="CURREN~1")) returned 1 [0029.424] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3b6860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3b6860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b8f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x0, dwReserved1=0x0, cFileName="Current Tabs", cAlternateFileName="CURREN~2")) returned 1 [0029.424] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="data_reduction_proxy_leveldb", cAlternateFileName="DATA_R~1")) returned 1 [0029.425] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.426] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.426] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0029.426] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x804795c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0029.426] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0029.426] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9ab9e110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0029.426] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0029.426] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0029.426] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.427] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x0, cFileName="Extension Rules", cAlternateFileName="EXTENS~3")) returned 1 [0029.427] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.429] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.429] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0029.429] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82adc050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82adc050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0029.429] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ad9940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0029.429] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0029.429] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0029.429] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0029.429] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.430] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x0, cFileName="Extension State", cAlternateFileName="EXTENS~2")) returned 1 [0029.430] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.432] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.432] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="000003.log", cAlternateFileName="")) returned 1 [0029.432] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824d3190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0029.432] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCK", cAlternateFileName="")) returned 1 [0029.432] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOG", cAlternateFileName="")) returned 1 [0029.432] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0029.432] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0029.432] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.433] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0029.433] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.435] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.435] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aapocclcgogkmnckokdopfmhonfmgoek", cAlternateFileName="AAPOCC~1")) returned 1 [0029.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0029.437] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.437] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0029.437] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0029.439] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.439] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0029.439] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 0x2020 [0029.440] VirtualAlloc (lpAddress=0x214000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x214000 [0029.440] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.440] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0029.441] ReadFile (in: hFile=0x10c, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0xd2c, lpOverlapped=0x0) returned 1 [0029.442] WriteFile (in: hFile=0x110, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0xd2c, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0xd2c, lpOverlapped=0x0) returned 1 [0029.443] ReadFile (in: hFile=0x10c, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.443] WriteFile (in: hFile=0x110, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.443] CloseHandle (hObject=0x10c) returned 1 [0029.443] CloseHandle (hObject=0x110) returned 1 [0029.445] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypt")) returned 0 [0029.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypt")) returned 0x2020 [0029.445] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x5d1fc8, dwReserved1=0x18e334, cFileName="icon_128.png", cAlternateFileName="")) returned 0x5c9040 [0029.445] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x5d1fc8, dwReserved1=0x18e334, cFileName="icon_128.png", cAlternateFileName="")) returned 0 [0029.445] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.445] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 1 [0029.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 0xffffffff [0029.447] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0029.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 0x2020 [0029.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0029.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.448] ReadFile (in: hFile=0x110, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0xa0, lpOverlapped=0x0) returned 1 [0029.449] WriteFile (in: hFile=0x10c, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0xa0, lpOverlapped=0x0) returned 1 [0029.449] ReadFile (in: hFile=0x110, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.450] WriteFile (in: hFile=0x10c, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.450] CloseHandle (hObject=0x110) returned 1 [0029.450] CloseHandle (hObject=0x10c) returned 1 [0029.451] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypt")) returned 0 [0029.451] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypt")) returned 0x2020 [0029.451] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x5d1fc0, dwReserved1=0x18e334, cFileName="icon_16.png", cAlternateFileName="")) returned 0x5c9040 [0029.451] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x5d1fc0, dwReserved1=0x18e334, cFileName="icon_16.png", cAlternateFileName="")) returned 0 [0029.451] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.451] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 1 [0029.452] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 0xffffffff [0029.452] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b74730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0029.452] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="main.js", cAlternateFileName="")) returned 1 [0029.452] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0029.452] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="_locales", cAlternateFileName="")) returned 1 [0029.452] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.454] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.454] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0029.454] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.455] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.455] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.455] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.455] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.455] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0029.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.455] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.455] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.455] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.455] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.455] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0029.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.456] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.456] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.456] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.456] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.456] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0029.456] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.456] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.456] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.457] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.457] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.457] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0029.457] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.457] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.458] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.458] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.458] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.458] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0029.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.458] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.458] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.458] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.458] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.458] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0029.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.459] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.459] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.459] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.459] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.459] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0029.459] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.460] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.460] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.460] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.460] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.460] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0029.460] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.461] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.461] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.461] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.461] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.461] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0029.461] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.462] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.462] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.462] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.462] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.462] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0029.462] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.463] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.463] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.463] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.463] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.463] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0029.463] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.464] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.464] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.464] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.464] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.464] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0029.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.464] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.464] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.464] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.464] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.464] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0029.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.465] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.465] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.465] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.465] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.465] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0029.465] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.465] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.466] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.466] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.466] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.466] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0029.466] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.466] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.466] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.467] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.467] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.467] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0029.467] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.468] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.469] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.469] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.469] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.469] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0029.469] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.470] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.470] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.470] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.470] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.470] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0029.470] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.470] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.470] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.470] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.470] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.470] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0029.470] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.471] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.471] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.471] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.471] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.471] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0029.471] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.471] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.471] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.472] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.472] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.472] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0029.472] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.472] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.472] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.473] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.473] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.473] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0029.473] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.473] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.473] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.473] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.473] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.473] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0029.473] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.474] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.474] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.474] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.474] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.474] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0029.474] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.474] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.474] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.474] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.474] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.474] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0029.474] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.475] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.475] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.475] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.475] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.475] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0029.475] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.476] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.476] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.476] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.476] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.476] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0029.476] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.478] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.478] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.478] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.478] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.478] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0029.478] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.479] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.479] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.479] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.479] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.479] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0029.479] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.480] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.480] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.480] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.480] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.480] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0029.480] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.481] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.481] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.481] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.481] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.481] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0029.481] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.487] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.487] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.487] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.487] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.488] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0029.488] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.488] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.488] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.488] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.488] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.488] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0029.488] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.490] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.490] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.490] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.490] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.490] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0029.490] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.490] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.490] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.490] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.490] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.490] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0029.490] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.492] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.492] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.492] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.492] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.492] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0029.492] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.493] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.493] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.493] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.493] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.493] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0029.493] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.494] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.494] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.494] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.495] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.495] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0029.495] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.495] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.495] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.495] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.495] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.495] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0029.495] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.501] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.501] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.501] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.501] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.501] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0029.501] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.501] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.501] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.501] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.501] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.501] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0029.501] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.502] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="..", cAlternateFileName="")) returned 1 [0029.502] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.502] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0xa21919f3, dwReserved1=0x6ef5dc30, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.502] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.502] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0029.502] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.502] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0029.502] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.503] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.503] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85d166b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0029.503] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0029.503] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0029.503] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.503] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0029.503] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0029.504] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 0 [0029.504] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0029.504] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aohghmighlieiainnegkcijnfilokake", cAlternateFileName="AOHGHM~1")) returned 1 [0029.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0029.504] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.504] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0029.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0029.507] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0029.507] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0029.507] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 0x2020 [0029.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0029.509] ReadFile (in: hFile=0x10c, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0xc8d, lpOverlapped=0x0) returned 1 [0029.510] WriteFile (in: hFile=0x110, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0xc8d, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0xc8d, lpOverlapped=0x0) returned 1 [0029.511] ReadFile (in: hFile=0x10c, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.511] WriteFile (in: hFile=0x110, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.511] CloseHandle (hObject=0x10c) returned 1 [0029.511] CloseHandle (hObject=0x110) returned 1 [0029.512] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypt")) returned 0 [0029.513] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypt")) returned 0x2020 [0029.513] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x5d1fc8, dwReserved1=0x18e334, cFileName="icon_128.png", cAlternateFileName="")) returned 0x5c9040 [0029.513] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x5d1fc8, dwReserved1=0x18e334, cFileName="icon_128.png", cAlternateFileName="")) returned 0 [0029.513] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.513] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 1 [0029.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 0xffffffff [0029.514] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0029.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 0x2020 [0029.515] VirtualAlloc (lpAddress=0x218000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x218000 [0029.515] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0029.515] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.523] ReadFile (in: hFile=0x110, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x8f, lpOverlapped=0x0) returned 1 [0029.525] WriteFile (in: hFile=0x10c, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x8f, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x8f, lpOverlapped=0x0) returned 1 [0029.526] ReadFile (in: hFile=0x110, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.526] WriteFile (in: hFile=0x10c, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.526] CloseHandle (hObject=0x110) returned 1 [0029.526] CloseHandle (hObject=0x10c) returned 1 [0029.527] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypt")) returned 0 [0029.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypt")) returned 0x2020 [0029.527] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f, dwReserved0=0x5d1fc0, dwReserved1=0x18e334, cFileName="icon_16.png", cAlternateFileName="")) returned 0x5c9040 [0029.527] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f, dwReserved0=0x5d1fc0, dwReserved1=0x18e334, cFileName="icon_16.png", cAlternateFileName="")) returned 0 [0029.527] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.527] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 1 [0029.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 0xffffffff [0029.528] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0029.528] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="main.js", cAlternateFileName="")) returned 1 [0029.528] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0029.528] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="_locales", cAlternateFileName="")) returned 1 [0029.528] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.530] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.530] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0029.530] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.531] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.531] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.531] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.531] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.531] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0029.531] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.531] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.531] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.531] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.531] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.531] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0029.531] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.534] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.534] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.534] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.534] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.534] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0029.534] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.535] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.535] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.535] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.535] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.535] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0029.535] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.536] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.536] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0029.536] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.536] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.536] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0029.536] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.537] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.537] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.537] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.537] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0029.537] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.537] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.538] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.538] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.538] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.538] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0029.538] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.538] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.538] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.539] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.539] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.539] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0029.539] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.540] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.540] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.540] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.540] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.540] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0029.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.540] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.540] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.540] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.540] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.541] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0029.541] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.542] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.542] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0029.542] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.542] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.542] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0029.542] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.543] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.543] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.543] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.543] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.543] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0029.543] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.543] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.543] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.543] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.544] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.544] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0029.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.544] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.544] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.544] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.544] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.545] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0029.545] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.545] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.545] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.545] VirtualAlloc (lpAddress=0x21c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x21c000 [0029.545] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.545] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.545] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0029.545] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.546] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.546] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.546] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.546] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.546] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0029.546] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.546] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.547] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.547] VirtualFree (lpAddress=0x21c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0029.547] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.547] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.547] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0029.547] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.548] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.548] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0029.548] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.548] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.548] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0029.548] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.549] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.549] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.549] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.549] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.549] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0029.549] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.549] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.549] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.550] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.550] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.550] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0029.550] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.550] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.550] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.550] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.551] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.551] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0029.551] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.551] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.551] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.551] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.551] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.551] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0029.551] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.552] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.552] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.552] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.552] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.552] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0029.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.552] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.552] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.552] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.552] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.552] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0029.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.553] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.553] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.553] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.553] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.553] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0029.553] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.554] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.554] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.554] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.554] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.554] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0029.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.555] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.555] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.555] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.555] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.555] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0029.555] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.555] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.555] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.555] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.555] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.555] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0029.555] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.556] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.556] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.556] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.556] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.556] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0029.556] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.557] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.557] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.557] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.557] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.557] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0029.557] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.557] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.558] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.558] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.558] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.558] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0029.558] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.558] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.558] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.558] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.558] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.558] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0029.558] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.559] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.559] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.559] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.559] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.559] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0029.559] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.559] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.559] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.559] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.560] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.560] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0029.560] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.560] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.560] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.561] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.561] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.561] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0029.561] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.561] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.561] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.561] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.561] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.562] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0029.562] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.563] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.563] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.563] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.563] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.563] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0029.563] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.563] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.563] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.563] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.564] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.564] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0029.564] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.564] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="..", cAlternateFileName="")) returned 1 [0029.564] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.564] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x4a3b8777, dwReserved1=0x56e8d18a, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.564] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.564] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0029.564] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.564] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0029.564] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.564] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.564] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0029.564] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0029.564] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0029.565] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.565] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1e90, dwReserved1=0x18e2cc, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0029.565] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0029.565] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 0 [0029.565] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0029.565] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="apdfllckaahabafndbhieahigkjlhalf", cAlternateFileName="APDFLL~1")) returned 1 [0029.565] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0029.565] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.565] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="14.1_0", cAlternateFileName="")) returned 1 [0029.565] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0029.567] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0029.567] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a33, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="128.png", cAlternateFileName="")) returned 1 [0029.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 0x2020 [0029.568] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.568] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0029.569] ReadFile (in: hFile=0x10c, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x1000, lpOverlapped=0x0) returned 1 [0029.571] WriteFile (in: hFile=0x110, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x1000, lpOverlapped=0x0) returned 1 [0029.572] ReadFile (in: hFile=0x10c, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0xa33, lpOverlapped=0x0) returned 1 [0029.572] WriteFile (in: hFile=0x110, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0xa33, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0xa33, lpOverlapped=0x0) returned 1 [0029.572] ReadFile (in: hFile=0x10c, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.572] WriteFile (in: hFile=0x110, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.572] CloseHandle (hObject=0x10c) returned 1 [0029.572] CloseHandle (hObject=0x110) returned 1 [0029.573] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypt")) returned 0 [0029.573] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypt")) returned 0x2020 [0029.573] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a33, dwReserved0=0x5d3fc0, dwReserved1=0x18e334, cFileName="128.png", cAlternateFileName="")) returned 0x5c9040 [0029.574] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a33, dwReserved0=0x5d3fc0, dwReserved1=0x18e334, cFileName="128.png", cAlternateFileName="")) returned 0 [0029.574] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.574] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 1 [0029.575] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 0xffffffff [0029.575] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8716c790, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0029.575] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_locales", cAlternateFileName="")) returned 1 [0029.575] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.576] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.576] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0029.576] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.577] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.577] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.577] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.577] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.577] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0029.577] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.578] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.578] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.578] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.578] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.578] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0029.578] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.578] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.578] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.578] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.578] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.578] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0029.578] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.579] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.579] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.579] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.579] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.579] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0029.579] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.580] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.580] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.580] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.580] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.580] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0029.580] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.581] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.581] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.581] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.581] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.581] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0029.581] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.581] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.581] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.581] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.581] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.581] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0029.581] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.582] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.582] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.582] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.582] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.582] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0029.582] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.583] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.583] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.583] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.583] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.583] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0029.583] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.584] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.584] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.584] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.584] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.584] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0029.584] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.584] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.584] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.584] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.584] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.584] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0029.584] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.585] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.585] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.585] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.585] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.585] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0029.585] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.586] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.586] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.586] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.586] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.586] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0029.586] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.587] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.587] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.587] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.587] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.587] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0029.587] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.587] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.587] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.587] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.587] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.587] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0029.587] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.588] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.588] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.588] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.588] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.588] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0029.588] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.589] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.589] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.589] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.589] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.589] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0029.589] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.590] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.590] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.590] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.590] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.590] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0029.590] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.590] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.590] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.590] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.590] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.590] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0029.590] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.591] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.591] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.591] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.591] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.591] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0029.591] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.591] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.592] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.592] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.592] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.592] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0029.592] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.593] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.593] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.593] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.593] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.593] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0029.593] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.593] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.593] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.593] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.593] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.593] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0029.593] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.594] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.594] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.594] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.594] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.594] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0029.594] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.594] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.595] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.595] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.595] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.595] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0029.595] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.595] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.595] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.596] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.596] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.596] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0029.596] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.596] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.596] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.596] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.596] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.596] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0029.596] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.599] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.599] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.599] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.599] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.600] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0029.600] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.600] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.600] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.600] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.600] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.600] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0029.600] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.601] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.601] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.601] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.601] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.601] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0029.601] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.601] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.601] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.601] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.601] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.602] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0029.602] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.603] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.603] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.603] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.603] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.603] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0029.603] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.603] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.603] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.603] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.604] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.604] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0029.604] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.604] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.604] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.605] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.605] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.605] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0029.605] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.605] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.605] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.605] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.605] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.605] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0029.605] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.606] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.606] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.606] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.606] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.606] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0029.606] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.606] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.606] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.606] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.606] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.607] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0029.607] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.607] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.607] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.607] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.607] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.607] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0029.608] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.608] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.608] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.608] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.608] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.608] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0029.608] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.609] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.609] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.609] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.609] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.609] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0029.609] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.609] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.609] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.609] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.610] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.610] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0029.610] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.610] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.610] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.610] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.611] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.611] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0029.611] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.611] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.611] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.611] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.611] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.611] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0029.611] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.612] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="..", cAlternateFileName="")) returned 1 [0029.612] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.612] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0xe7543db6, dwReserved1=0xb3869fce, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.612] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.612] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0029.612] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.612] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0029.612] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.612] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.612] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0029.612] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0029.613] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.613] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0029.613] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0029.613] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x871928f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="14.1_0", cAlternateFileName="")) returned 0 [0029.613] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0029.613] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="blpcfgokakmgnkcojhhkbfbldkacnbeo", cAlternateFileName="BLPCFG~1")) returned 1 [0029.613] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0029.613] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.613] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 1 [0029.613] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0029.616] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0029.616] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="128.png", cAlternateFileName="")) returned 1 [0029.616] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 0x2020 [0029.618] VirtualAlloc (lpAddress=0x21c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x21c000 [0029.618] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0029.618] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.619] ReadFile (in: hFile=0x110, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0xd4e, lpOverlapped=0x0) returned 1 [0029.620] WriteFile (in: hFile=0x10c, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0xd4e, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0xd4e, lpOverlapped=0x0) returned 1 [0029.621] ReadFile (in: hFile=0x110, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.621] WriteFile (in: hFile=0x10c, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.621] CloseHandle (hObject=0x110) returned 1 [0029.621] CloseHandle (hObject=0x10c) returned 1 [0029.622] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypt")) returned 0 [0029.622] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypt")) returned 0x2020 [0029.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x5d3fc0, dwReserved1=0x18e334, cFileName="128.png", cAlternateFileName="")) returned 0x5c9040 [0029.622] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x5d3fc0, dwReserved1=0x18e334, cFileName="128.png", cAlternateFileName="")) returned 0 [0029.622] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.622] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 1 [0029.623] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 0xffffffff [0029.623] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0029.623] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_locales", cAlternateFileName="")) returned 1 [0029.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.625] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.625] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0029.625] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.625] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.625] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.625] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.625] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.625] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0029.626] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.626] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.626] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.626] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.626] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.627] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0029.627] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.627] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.627] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.627] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.627] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.627] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0029.627] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.628] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.628] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.628] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.628] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.628] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0029.628] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.628] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.628] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.628] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.628] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.628] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0029.628] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.629] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.629] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.629] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.629] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.629] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0029.629] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.630] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.630] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.630] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.630] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.630] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0029.630] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.631] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.631] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.631] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.631] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.631] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0029.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.631] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.631] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.631] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.631] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.631] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0029.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.632] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.632] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.632] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.632] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.632] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0029.632] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.632] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.633] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.633] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.633] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.633] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0029.633] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.634] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.634] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.634] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.634] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.634] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0029.634] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.634] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.634] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.634] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.634] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.634] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0029.634] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.635] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.635] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.635] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.635] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.635] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0029.635] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.636] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.636] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.636] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.636] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.636] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0029.636] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.637] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.637] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.637] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.637] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.637] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0029.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.637] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.637] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.637] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.637] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.637] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0029.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.638] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.638] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.638] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.638] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.638] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0029.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.639] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.639] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.639] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.639] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.639] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0029.639] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.639] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.640] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.640] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.640] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.640] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0029.640] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.640] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.640] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.640] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.640] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.640] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0029.640] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.641] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.641] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.641] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.641] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.641] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0029.641] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.641] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.641] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.641] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.642] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.642] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0029.642] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.642] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.642] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.642] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.643] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.643] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0029.643] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.643] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.643] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.643] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.643] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.643] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0029.643] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.644] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.644] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.644] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.644] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.644] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0029.644] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.644] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.644] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.644] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.644] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.644] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0029.645] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.645] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.645] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.645] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.645] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.646] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0029.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.646] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.646] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.646] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.646] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.646] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0029.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.647] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.647] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.647] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.647] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.647] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0029.647] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.647] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.647] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.647] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.647] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.647] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0029.647] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.648] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.648] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.648] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.657] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.657] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0029.657] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.657] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.657] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.657] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.657] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.657] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0029.657] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.658] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.658] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.658] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.658] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.658] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0029.658] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.658] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.659] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.659] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.659] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.659] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0029.659] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.660] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.660] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.660] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.660] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.660] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0029.660] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.660] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.660] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.660] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.660] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.660] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0029.660] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.661] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.661] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.661] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.661] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.661] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0029.661] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.661] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="..", cAlternateFileName="")) returned 1 [0029.662] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.662] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xccb8a84c, dwReserved1=0xd8c3a988, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.662] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.662] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0029.662] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.662] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0029.662] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.664] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.664] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0029.664] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0029.665] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.665] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0029.665] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0029.665] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85639950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 0 [0029.665] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0029.665] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="felcaaldnbdncclmgdcncolpebgiejap", cAlternateFileName="FELCAA~1")) returned 1 [0029.665] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0029.666] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.666] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName="1.1_0", cAlternateFileName="")) returned 1 [0029.666] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0029.668] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0029.668] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84234950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd47, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="icon_128.png", cAlternateFileName="")) returned 1 [0029.668] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 0x2020 [0029.669] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.669] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0029.669] ReadFile (in: hFile=0x10c, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0xd47, lpOverlapped=0x0) returned 1 [0029.671] WriteFile (in: hFile=0x110, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0xd47, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0xd47, lpOverlapped=0x0) returned 1 [0029.672] ReadFile (in: hFile=0x10c, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.672] WriteFile (in: hFile=0x110, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.672] CloseHandle (hObject=0x10c) returned 1 [0029.672] CloseHandle (hObject=0x110) returned 1 [0029.673] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypt")) returned 0 [0029.673] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypt")) returned 0x2020 [0029.673] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84234950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd47, dwReserved0=0x5d3fc8, dwReserved1=0x18e334, cFileName="icon_128.png", cAlternateFileName="")) returned 0x5c9040 [0029.673] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84234950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd47, dwReserved0=0x5d3fc8, dwReserved1=0x18e334, cFileName="icon_128.png", cAlternateFileName="")) returned 0 [0029.673] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.673] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 1 [0029.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 0xffffffff [0029.674] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84239770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x5d3e90, dwReserved1=0x18e2cc, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0029.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 0x2020 [0029.675] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0029.675] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.675] ReadFile (in: hFile=0x110, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x9d, lpOverlapped=0x0) returned 1 [0029.676] WriteFile (in: hFile=0x10c, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x9d, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x9d, lpOverlapped=0x0) returned 1 [0029.677] ReadFile (in: hFile=0x110, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.677] WriteFile (in: hFile=0x10c, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.677] CloseHandle (hObject=0x110) returned 1 [0029.677] CloseHandle (hObject=0x10c) returned 1 [0029.678] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypt")) returned 0 [0029.678] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypt")) returned 0x2020 [0029.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84239770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x5d3fc0, dwReserved1=0x18e334, cFileName="icon_16.png", cAlternateFileName="")) returned 0x5c9040 [0029.679] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84239770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844b1ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x5d3fc0, dwReserved1=0x18e334, cFileName="icon_16.png", cAlternateFileName="")) returned 0 [0029.679] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.679] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 1 [0029.679] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 0xffffffff [0029.680] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8423be80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8423e590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x5d3e90, dwReserved1=0x18e2cc, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0029.680] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84240ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84240ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x5d3e90, dwReserved1=0x18e2cc, cFileName="main.js", cAlternateFileName="")) returned 1 [0029.680] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x840205b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84245ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844aa770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x5d3e90, dwReserved1=0x18e2cc, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0029.680] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d3e90, dwReserved1=0x18e2cc, cFileName="_locales", cAlternateFileName="")) returned 1 [0029.680] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.681] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.681] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0029.681] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.681] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.682] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.682] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.682] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.682] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0029.682] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.682] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.683] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.683] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.683] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.683] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0029.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.683] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.683] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.683] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.683] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.683] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0029.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.684] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.684] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.684] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.684] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.684] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0029.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.684] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.684] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.684] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.684] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.685] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0029.685] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.685] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.685] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.685] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.685] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.686] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0029.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.686] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.686] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.686] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.686] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.686] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0029.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.687] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.687] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.687] VirtualAlloc (lpAddress=0x220000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x220000 [0029.687] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.687] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.687] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0029.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.688] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.688] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.688] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.688] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.688] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0029.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.689] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.689] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.689] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.689] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.691] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0029.691] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.692] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.692] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.692] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.692] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.692] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0029.692] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.692] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.693] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.693] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.693] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.693] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0029.693] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.693] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.694] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.694] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.694] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.694] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0029.694] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.695] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.695] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.695] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.695] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.695] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0029.695] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.695] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.695] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.695] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.696] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.696] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0029.696] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.697] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.697] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.697] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.697] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.697] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0029.697] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.697] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="..", cAlternateFileName="")) returned 1 [0029.697] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.697] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.697] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.698] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0029.698] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.700] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.700] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.701] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.702] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.702] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.703] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.703] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.704] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.704] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.705] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.705] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.706] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.706] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.706] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.707] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.708] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.708] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.708] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.708] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.709] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.709] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.710] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.710] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.710] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.710] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.711] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.711] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.712] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.712] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.712] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.712] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.713] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.713] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbb795fc0, dwReserved1=0x35660fb7, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.714] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.714] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.714] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.714] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0029.714] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0029.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0029.715] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0029.717] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 0x2020 [0029.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0029.717] ReadFile (in: hFile=0x10c, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x1000, lpOverlapped=0x0) returned 1 [0029.719] WriteFile (in: hFile=0x110, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x1000, lpOverlapped=0x0) returned 1 [0029.720] ReadFile (in: hFile=0x10c, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x378, lpOverlapped=0x0) returned 1 [0029.721] WriteFile (in: hFile=0x110, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x378, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x378, lpOverlapped=0x0) returned 1 [0029.721] ReadFile (in: hFile=0x10c, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.721] WriteFile (in: hFile=0x110, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.721] CloseHandle (hObject=0x10c) returned 1 [0029.721] CloseHandle (hObject=0x110) returned 1 [0029.722] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypt")) returned 0 [0029.722] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypt")) returned 0x2020 [0029.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x5d3fb8, dwReserved1=0x18e334, cFileName="128.png", cAlternateFileName="")) returned 0x5c9040 [0029.722] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x862fc2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x5d3fb8, dwReserved1=0x18e334, cFileName="128.png", cAlternateFileName="")) returned 0 [0029.722] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.722] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 1 [0029.723] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 0xffffffff [0029.723] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="contentscript_bin_prod.js", cAlternateFileName="CONTEN~1.JS")) returned 1 [0029.723] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="dasherSettingSchema.json", cAlternateFileName="DASHER~1.JSO")) returned 1 [0029.723] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x5b6c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="eventpage_bin_prod.js", cAlternateFileName="EVENTP~1.JS")) returned 1 [0029.723] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0029.723] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="page_embed_script.js", cAlternateFileName="PAGE_E~1.JS")) returned 1 [0029.723] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_locales", cAlternateFileName="")) returned 1 [0029.723] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.725] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.725] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="af", cAlternateFileName="")) returned 1 [0029.726] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.726] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.726] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.726] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.729] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.729] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="am", cAlternateFileName="")) returned 1 [0029.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.730] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.730] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.730] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.730] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.730] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0029.730] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.730] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.731] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.731] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.731] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.731] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="az", cAlternateFileName="")) returned 1 [0029.731] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.731] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.731] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.731] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.731] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.731] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0029.731] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.732] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.732] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.732] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.732] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.732] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bn", cAlternateFileName="")) returned 1 [0029.732] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.732] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.732] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.732] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.732] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.733] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0029.733] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.733] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.733] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.733] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.733] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.734] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0029.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.734] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.734] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.734] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.734] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.734] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0029.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.735] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.735] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.735] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.735] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.735] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0029.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.735] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.735] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.735] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.735] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.735] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0029.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.736] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.736] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.736] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.736] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.736] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0029.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.737] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.737] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.737] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.737] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.737] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0029.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.738] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.738] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.738] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.738] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.738] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0029.738] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.738] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.738] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.738] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.738] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.738] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0029.738] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.739] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.739] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.739] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.739] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.739] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0029.739] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.740] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.740] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.740] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.740] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.740] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0029.740] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.741] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.741] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.741] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.741] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.741] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fa", cAlternateFileName="")) returned 1 [0029.741] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.741] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.741] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.741] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.741] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.742] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0029.742] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.743] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.743] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.743] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.743] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.743] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0029.743] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.744] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.744] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.744] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.744] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.744] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0029.744] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.745] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.745] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.745] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.745] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.745] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr_CA", cAlternateFileName="")) returned 1 [0029.745] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.745] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.746] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.746] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.746] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.746] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0029.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.746] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.746] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.746] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.746] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.746] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="gu", cAlternateFileName="")) returned 1 [0029.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.747] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.747] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.747] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.747] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.747] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0029.747] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.747] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.747] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.747] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.747] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.748] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0029.748] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.748] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.748] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.748] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.748] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.749] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0029.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.749] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.749] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.749] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.749] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.749] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hy", cAlternateFileName="")) returned 1 [0029.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.750] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.750] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.750] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.750] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.750] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0029.750] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.750] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.750] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.750] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.750] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.750] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="is", cAlternateFileName="")) returned 1 [0029.750] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.751] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.751] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.751] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.751] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.751] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0029.751] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.752] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.752] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.752] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.752] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.752] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="iw", cAlternateFileName="")) returned 1 [0029.752] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.753] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.753] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.753] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.753] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.753] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0029.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.753] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.753] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.753] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.753] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.753] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ka", cAlternateFileName="")) returned 1 [0029.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.754] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.754] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.754] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.754] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.754] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="km", cAlternateFileName="")) returned 1 [0029.754] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.754] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.754] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.754] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.755] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.755] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="kn", cAlternateFileName="")) returned 1 [0029.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.755] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.755] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.755] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.756] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.756] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0029.756] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.756] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.756] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.756] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.756] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.756] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lo", cAlternateFileName="")) returned 1 [0029.756] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.757] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.757] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.757] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.757] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.757] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0029.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.758] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.758] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.758] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.758] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.758] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0029.759] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.759] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.759] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.759] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.759] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.759] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ml", cAlternateFileName="")) returned 1 [0029.760] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.760] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.760] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.760] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.760] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.760] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="mn", cAlternateFileName="")) returned 1 [0029.760] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.761] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.761] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.761] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.761] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.761] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="mr", cAlternateFileName="")) returned 1 [0029.761] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.761] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.761] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.761] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.761] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.761] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0029.761] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.762] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.762] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.762] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.762] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.762] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ne", cAlternateFileName="")) returned 1 [0029.762] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.763] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.763] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.763] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.763] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.763] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0029.763] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.763] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.764] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.764] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.764] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.764] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0029.764] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.764] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.764] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.764] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.764] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.764] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0029.764] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.765] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.765] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.765] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.765] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.765] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0029.765] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.765] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.765] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.765] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.765] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.766] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0029.766] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.766] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.766] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.766] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.766] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.767] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0029.767] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.767] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.767] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.767] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.767] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.767] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0029.767] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.768] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.768] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.768] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.768] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.768] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0029.768] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.768] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.768] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.768] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.768] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.768] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0029.768] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.769] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.769] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.769] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.769] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.769] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0029.769] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.770] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.770] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.770] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.770] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.770] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0029.770] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.771] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.771] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.771] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.771] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.771] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0029.771] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.771] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.771] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.771] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.771] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.771] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sw", cAlternateFileName="")) returned 1 [0029.771] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.772] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.772] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.772] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.772] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.772] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ta", cAlternateFileName="")) returned 1 [0029.772] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.772] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.772] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.772] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.772] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.773] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="te", cAlternateFileName="")) returned 1 [0029.773] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.773] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="..", cAlternateFileName="")) returned 1 [0029.774] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.774] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.774] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.774] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0029.774] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.775] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.775] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.776] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.776] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.776] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.776] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.777] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.777] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.777] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.777] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.778] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.778] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.779] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.779] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.780] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.780] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf978cb27, dwReserved1=0xecd96817, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.780] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.780] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.781] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.781] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.781] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0029.782] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0029.784] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69726373, dwReserved1=0x6a2e7470, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0029.785] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0029.786] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630063, dwReserved1=0x67006d, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.787] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.787] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630063, dwReserved1=0x67006d, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.788] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.788] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630063, dwReserved1=0x67006d, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.790] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 0x2020 [0029.790] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.790] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0029.790] ReadFile (in: hFile=0x10c, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0x1000, lpOverlapped=0x0) returned 1 [0029.795] WriteFile (in: hFile=0x114, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0x1000, lpOverlapped=0x0) returned 1 [0029.796] ReadFile (in: hFile=0x10c, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0x109, lpOverlapped=0x0) returned 1 [0029.796] WriteFile (in: hFile=0x114, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0x109, lpOverlapped=0x0) returned 1 [0029.796] ReadFile (in: hFile=0x10c, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.796] WriteFile (in: hFile=0x114, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.796] CloseHandle (hObject=0x10c) returned 1 [0029.796] CloseHandle (hObject=0x114) returned 1 [0029.797] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypt")) returned 0 [0029.798] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypt")) returned 0x2020 [0029.798] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828af610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1109, dwReserved0=0x5d4fe0, dwReserved1=0x18e0cc, cFileName="icon_128.png", cAlternateFileName="")) returned 0x5c9080 [0029.798] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828af610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1109, dwReserved0=0x5d4fe0, dwReserved1=0x18e0cc, cFileName="icon_128.png", cAlternateFileName="")) returned 0 [0029.798] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.798] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 1 [0029.799] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 0xffffffff [0029.799] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828c7cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="icon_16.png", cAlternateFileName="")) returned 1 [0029.799] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 0x2020 [0029.800] VirtualAlloc (lpAddress=0x224000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x224000 [0029.800] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0029.800] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.800] ReadFile (in: hFile=0x114, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0x22c, lpOverlapped=0x0) returned 1 [0029.801] WriteFile (in: hFile=0x10c, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0x22c, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0x22c, lpOverlapped=0x0) returned 1 [0029.802] ReadFile (in: hFile=0x114, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.802] WriteFile (in: hFile=0x10c, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.802] CloseHandle (hObject=0x114) returned 1 [0029.802] CloseHandle (hObject=0x10c) returned 1 [0029.803] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypt")) returned 0 [0029.803] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypt")) returned 0x2020 [0029.804] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828c7cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x5d4fe0, dwReserved1=0x18e0cc, cFileName="icon_16.png", cAlternateFileName="")) returned 0x5c9080 [0029.804] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828c7cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82aab310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x5d4fe0, dwReserved1=0x18e0cc, cFileName="icon_16.png", cAlternateFileName="")) returned 0 [0029.804] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.804] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 1 [0029.805] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 0xffffffff [0029.805] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ccad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ccad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="topbar_floating_button.png", cAlternateFileName="TOPBAR~1.PNG")) returned 1 [0029.805] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 0x2020 [0029.805] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.805] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0029.806] ReadFile (in: hFile=0x10c, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0xa0, lpOverlapped=0x0) returned 1 [0029.806] WriteFile (in: hFile=0x114, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0xa0, lpOverlapped=0x0) returned 1 [0029.807] ReadFile (in: hFile=0x10c, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.807] WriteFile (in: hFile=0x114, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.807] CloseHandle (hObject=0x10c) returned 1 [0029.807] CloseHandle (hObject=0x114) returned 1 [0029.808] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypt")) returned 0 [0029.808] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypt")) returned 0x2020 [0029.808] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ccad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ccad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x5d5000, dwReserved1=0x18e0cc, cFileName="topbar_floating_button.png", cAlternateFileName="TOPBAR~1.PNG")) returned 0x5c9080 [0029.809] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ccad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ccad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x5d5000, dwReserved1=0x18e0cc, cFileName="topbar_floating_button.png", cAlternateFileName="TOPBAR~1.PNG")) returned 0 [0029.809] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.809] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 1 [0029.810] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 0xffffffff [0029.810] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828cf1e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d18f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="topbar_floating_button_close.png", cAlternateFileName="TOPBAR~2.PNG")) returned 1 [0029.810] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 0x2020 [0029.810] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0029.810] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.810] ReadFile (in: hFile=0x114, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0xfc, lpOverlapped=0x0) returned 1 [0029.811] WriteFile (in: hFile=0x10c, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0xfc, lpOverlapped=0x0) returned 1 [0029.812] ReadFile (in: hFile=0x114, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.812] WriteFile (in: hFile=0x10c, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.812] CloseHandle (hObject=0x114) returned 1 [0029.812] CloseHandle (hObject=0x10c) returned 1 [0029.813] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypt")) returned 0 [0029.813] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypt")) returned 0x2020 [0029.813] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828cf1e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d18f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x5d5008, dwReserved1=0x18e0cc, cFileName="topbar_floating_button_close.png", cAlternateFileName="TOPBAR~2.PNG")) returned 0x5c9080 [0029.813] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828cf1e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d18f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x5d5008, dwReserved1=0x18e0cc, cFileName="topbar_floating_button_close.png", cAlternateFileName="TOPBAR~2.PNG")) returned 0 [0029.813] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.813] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 1 [0029.815] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 0xffffffff [0029.815] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d6710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d6710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="topbar_floating_button_hover.png", cAlternateFileName="TOPBAR~3.PNG")) returned 1 [0029.815] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 0x2020 [0029.815] VirtualAlloc (lpAddress=0x228000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x228000 [0029.815] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.815] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0029.816] ReadFile (in: hFile=0x10c, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0xa0, lpOverlapped=0x0) returned 1 [0029.817] WriteFile (in: hFile=0x114, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0xa0, lpOverlapped=0x0) returned 1 [0029.817] ReadFile (in: hFile=0x10c, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.818] WriteFile (in: hFile=0x114, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.818] CloseHandle (hObject=0x10c) returned 1 [0029.818] CloseHandle (hObject=0x114) returned 1 [0029.818] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypt")) returned 0 [0029.819] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypt")) returned 0x2020 [0029.819] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d6710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d6710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x5d5008, dwReserved1=0x18e0cc, cFileName="topbar_floating_button_hover.png", cAlternateFileName="TOPBAR~3.PNG")) returned 0x5c9080 [0029.819] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d6710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d6710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x5d5008, dwReserved1=0x18e0cc, cFileName="topbar_floating_button_hover.png", cAlternateFileName="TOPBAR~3.PNG")) returned 0 [0029.819] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.819] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 1 [0029.820] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 0xffffffff [0029.820] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d8e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d8e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="topbar_floating_button_maximize.png", cAlternateFileName="TOPBAR~4.PNG")) returned 1 [0029.820] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 0x2020 [0029.821] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0029.821] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.821] ReadFile (in: hFile=0x114, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0xa6, lpOverlapped=0x0) returned 1 [0029.822] WriteFile (in: hFile=0x10c, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0xa6, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0xa6, lpOverlapped=0x0) returned 1 [0029.823] ReadFile (in: hFile=0x114, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.823] WriteFile (in: hFile=0x10c, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.823] CloseHandle (hObject=0x114) returned 1 [0029.823] CloseHandle (hObject=0x10c) returned 1 [0029.824] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypt")) returned 0 [0029.824] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypt")) returned 0x2020 [0029.824] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d8e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d8e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x5d5010, dwReserved1=0x18e0cc, cFileName="topbar_floating_button_maximize.png", cAlternateFileName="TOPBAR~4.PNG")) returned 0x5c9080 [0029.824] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828d8e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828d8e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x5d5010, dwReserved1=0x18e0cc, cFileName="topbar_floating_button_maximize.png", cAlternateFileName="TOPBAR~4.PNG")) returned 0 [0029.825] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.825] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 1 [0029.825] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 0xffffffff [0029.826] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 1 [0029.826] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 0x2020 [0029.826] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.826] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0029.826] ReadFile (in: hFile=0x10c, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0xa0, lpOverlapped=0x0) returned 1 [0029.827] WriteFile (in: hFile=0x114, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0xa0, lpOverlapped=0x0) returned 1 [0029.828] ReadFile (in: hFile=0x10c, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.828] WriteFile (in: hFile=0x114, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.828] CloseHandle (hObject=0x10c) returned 1 [0029.828] CloseHandle (hObject=0x114) returned 1 [0029.829] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypt")) returned 0 [0029.829] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypt")) returned 0x2020 [0029.829] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x5d5010, dwReserved1=0x18e0cc, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 0x5c9080 [0029.829] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x5d5010, dwReserved1=0x18e0cc, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 0 [0029.829] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.829] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 1 [0029.830] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 0xffffffff [0029.830] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828ddc40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828ddc40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="topbar_floating_button_pressed.png", cAlternateFileName="TOF9E1~1.PNG")) returned 0 [0029.830] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.830] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826545a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e2a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aa3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x676e6974, dwReserved1=0x7475625f, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0029.830] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6974, dwReserved1=0x7475625f, cFileName="_locales", cAlternateFileName="")) returned 1 [0029.830] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.832] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="..", cAlternateFileName="")) returned 1 [0029.832] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="bg", cAlternateFileName="")) returned 1 [0029.832] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.832] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.832] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.832] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.832] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.833] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ca", cAlternateFileName="")) returned 1 [0029.833] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.833] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.833] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.833] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.833] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.833] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="cs", cAlternateFileName="")) returned 1 [0029.833] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.834] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.834] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.834] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.834] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.834] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="da", cAlternateFileName="")) returned 1 [0029.834] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.835] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.835] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.835] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.835] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.835] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="de", cAlternateFileName="")) returned 1 [0029.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.835] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.835] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.835] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.835] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.835] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="el", cAlternateFileName="")) returned 1 [0029.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.836] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.836] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.837] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.837] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.837] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="en", cAlternateFileName="")) returned 1 [0029.837] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.837] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.837] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.837] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.837] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.837] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="en_GB", cAlternateFileName="")) returned 1 [0029.837] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.838] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.838] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.838] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.838] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.838] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="es", cAlternateFileName="")) returned 1 [0029.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.838] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.838] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.838] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.838] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.838] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="es_419", cAlternateFileName="")) returned 1 [0029.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.839] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.839] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.839] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.839] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.839] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="et", cAlternateFileName="")) returned 1 [0029.840] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.840] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.840] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.840] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.840] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.840] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="fi", cAlternateFileName="")) returned 1 [0029.840] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.841] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.841] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.841] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.841] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.841] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="fil", cAlternateFileName="")) returned 1 [0029.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.841] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.841] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.841] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.841] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.841] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="fr", cAlternateFileName="")) returned 1 [0029.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.842] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.842] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.842] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.842] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.842] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="hi", cAlternateFileName="")) returned 1 [0029.842] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.842] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.842] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.843] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.843] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.843] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="hr", cAlternateFileName="")) returned 1 [0029.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.843] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.843] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.843] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.844] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.844] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="hu", cAlternateFileName="")) returned 1 [0029.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.844] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.844] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.844] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.844] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.844] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="id", cAlternateFileName="")) returned 1 [0029.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.845] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.845] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.845] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.845] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.845] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="it", cAlternateFileName="")) returned 1 [0029.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.845] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.845] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.845] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.845] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.845] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ja", cAlternateFileName="")) returned 1 [0029.846] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.846] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.846] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.846] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.846] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.846] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ko", cAlternateFileName="")) returned 1 [0029.847] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.847] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.847] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.847] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.847] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.847] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="lt", cAlternateFileName="")) returned 1 [0029.847] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.848] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.848] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.848] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.848] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.848] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="lv", cAlternateFileName="")) returned 1 [0029.848] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.848] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.848] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.848] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.848] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.848] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="nb", cAlternateFileName="")) returned 1 [0029.848] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.849] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.849] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.849] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.849] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.849] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="nl", cAlternateFileName="")) returned 1 [0029.849] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.850] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.850] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.850] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.850] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.850] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="pl", cAlternateFileName="")) returned 1 [0029.850] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.850] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.851] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.851] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.851] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.851] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0029.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.851] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.851] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.851] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.851] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.851] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0029.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.853] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.853] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.853] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.853] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.853] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ro", cAlternateFileName="")) returned 1 [0029.853] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.853] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.853] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.853] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.853] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.853] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ru", cAlternateFileName="")) returned 1 [0029.853] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.854] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.854] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.854] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.854] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.854] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="sk", cAlternateFileName="")) returned 1 [0029.854] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.855] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.855] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.855] VirtualAlloc (lpAddress=0x22c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x22c000 [0029.855] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.855] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.855] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="sl", cAlternateFileName="")) returned 1 [0029.855] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.856] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.856] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.856] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.856] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.856] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="sr", cAlternateFileName="")) returned 1 [0029.856] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.856] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.856] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.856] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.856] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.857] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="sv", cAlternateFileName="")) returned 1 [0029.857] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.860] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.860] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.860] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.860] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.860] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="th", cAlternateFileName="")) returned 1 [0029.860] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.860] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.860] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.860] VirtualFree (lpAddress=0x22c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0029.860] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.861] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.861] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="tr", cAlternateFileName="")) returned 1 [0029.861] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.861] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.861] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.861] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.862] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.862] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="uk", cAlternateFileName="")) returned 1 [0029.862] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.862] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.862] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.862] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.862] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.862] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="vi", cAlternateFileName="")) returned 1 [0029.862] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.863] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.863] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.863] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.863] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.863] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0029.863] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.863] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.863] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.863] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.863] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.864] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0029.864] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.864] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.864] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.864] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.864] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.865] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0029.865] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.865] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6974, dwReserved1=0x7475625f, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0029.865] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.865] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="..", cAlternateFileName="")) returned 1 [0029.865] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0029.865] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0029.865] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.865] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6974, dwReserved1=0x7475625f, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0029.865] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0029.865] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69726373, dwReserved1=0x6a2e7470, cFileName="1.0.0.2_0", cAlternateFileName="100~1.2_0")) returned 0 [0029.865] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0029.865] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pjkljhegncpnkpknbcohdijeoejaedia", cAlternateFileName="PJKLJH~1")) returned 1 [0029.865] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0029.866] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="..", cAlternateFileName="")) returned 1 [0029.866] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="8.1_0", cAlternateFileName="")) returned 1 [0029.866] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0029.868] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0029.868] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="128.png", cAlternateFileName="")) returned 1 [0029.868] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 0x2020 [0029.869] VirtualAlloc (lpAddress=0x22c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x22c000 [0029.869] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0029.869] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0029.869] ReadFile (in: hFile=0x110, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x1000, lpOverlapped=0x0) returned 1 [0029.871] WriteFile (in: hFile=0x114, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x1000, lpOverlapped=0x0) returned 1 [0029.872] ReadFile (in: hFile=0x110, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x80f, lpOverlapped=0x0) returned 1 [0029.873] WriteFile (in: hFile=0x114, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x80f, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x80f, lpOverlapped=0x0) returned 1 [0029.873] ReadFile (in: hFile=0x110, lpBuffer=0x18c320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18c320*, lpNumberOfBytesRead=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.873] WriteFile (in: hFile=0x114, lpBuffer=0x18d320*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c06c, lpOverlapped=0x0 | out: lpBuffer=0x18d320*, lpNumberOfBytesWritten=0x18c06c*=0x0, lpOverlapped=0x0) returned 1 [0029.873] CloseHandle (hObject=0x110) returned 1 [0029.873] CloseHandle (hObject=0x114) returned 1 [0029.874] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypt")) returned 0 [0029.874] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypt")) returned 0x2020 [0029.874] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x5d3fb8, dwReserved1=0x18e334, cFileName="128.png", cAlternateFileName="")) returned 0x5c9040 [0029.874] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e1bc | out: lpFindFileData=0x18e1bc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x5d3fb8, dwReserved1=0x18e334, cFileName="128.png", cAlternateFileName="")) returned 0 [0029.874] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.874] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 1 [0029.875] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 0xffffffff [0029.875] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x869b0fb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0029.875] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_locales", cAlternateFileName="")) returned 1 [0029.875] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.877] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.877] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0029.877] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.878] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.878] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.878] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.878] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.879] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0029.879] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.880] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.880] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.880] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.880] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.880] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0029.880] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.881] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.881] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.881] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.881] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.881] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0029.881] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.882] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.882] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.882] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.882] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.882] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0029.882] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.883] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.883] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.883] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.883] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.883] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0029.883] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.891] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.892] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.892] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.892] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.892] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0029.892] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.893] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.893] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.893] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.893] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.893] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0029.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.893] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.893] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.893] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.893] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.893] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0029.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.893] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.893] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.894] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.894] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.894] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0029.894] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.894] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.894] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.895] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.895] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.895] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0029.895] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.895] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.895] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.895] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.895] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.896] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0029.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.896] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.896] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.896] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.896] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.896] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0029.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.896] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.896] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.896] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.896] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.896] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0029.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.897] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.897] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.897] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.897] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.897] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0029.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.897] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.897] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.897] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.897] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.897] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0029.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.897] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.898] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.898] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.898] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.898] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0029.898] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.899] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.899] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.899] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.899] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.899] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0029.899] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.899] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.899] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.899] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.899] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.899] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0029.899] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.900] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.900] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.900] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.900] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.900] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0029.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.900] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.900] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.900] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.900] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.900] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0029.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.900] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.901] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.901] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.901] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.901] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0029.901] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.901] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.901] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.901] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.901] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.901] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0029.901] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.901] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.901] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.901] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.901] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.902] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0029.902] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.902] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.902] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.902] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.902] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.902] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0029.902] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.903] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.903] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.903] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.903] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.903] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0029.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.903] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.903] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.904] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.904] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.904] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0029.904] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.904] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.904] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.904] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.904] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.904] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0029.904] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.904] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.904] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.904] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.904] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.904] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="se", cAlternateFileName="")) returned 1 [0029.905] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.905] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.905] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.905] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.905] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.905] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0029.905] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.905] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.905] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.905] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.905] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.905] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0029.905] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.905] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.906] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.906] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.906] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.906] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0029.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.906] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.906] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.906] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.906] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.906] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0029.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.907] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.907] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.907] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.907] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.907] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0029.907] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.907] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.907] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.907] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.907] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.908] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0029.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.908] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.908] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.908] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.908] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.908] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0029.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.908] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.908] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.908] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.908] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.908] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0029.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.909] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.909] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.909] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.909] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.909] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0029.909] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.909] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="..", cAlternateFileName="")) returned 1 [0029.909] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.909] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x3ff0a6f9, dwReserved1=0xf140e7e5, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.909] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.909] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0029.909] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.909] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0029.909] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.910] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.910] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0029.910] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x771a6e6f, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0029.910] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.910] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0029.910] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0029.910] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86d1bfb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="8.1_0", cAlternateFileName="")) returned 0 [0029.910] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0029.910] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0029.910] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0029.911] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="..", cAlternateFileName="")) returned 1 [0029.911] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 1 [0029.911] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0029.913] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="..", cAlternateFileName="")) returned 1 [0029.914] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0bf, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="angular.js", cAlternateFileName="")) returned 1 [0029.914] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83641800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83643f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xa89c, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="background_script.js", cAlternateFileName="BACKGR~1.JS")) returned 1 [0029.914] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83646620, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83648d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x181aa, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="cast_game_sender.js", cAlternateFileName="CAST_G~1.JS")) returned 1 [0029.914] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8364db50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8364db50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="cast_route_details.html", cAlternateFileName="CAST_R~1.HTM")) returned 1 [0029.914] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83652970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83657790, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3a258, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="cast_route_details.js", cAlternateFileName="CAST_R~1.JS")) returned 1 [0029.914] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8365ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836613d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xce17, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="cast_sender.js", cAlternateFileName="CAST_S~1.JS")) returned 1 [0029.914] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e65746e, dwReserved1=0x6a2e7374, cFileName="cast_setup", cAlternateFileName="CAST_S~1")) returned 1 [0029.914] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63006d, dwReserved1=0x62006a, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.916] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63006d, dwReserved1=0x62006a, cFileName="..", cAlternateFileName="")) returned 1 [0029.916] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1a1d, dwReserved0=0x63006d, dwReserved1=0x62006a, cFileName="cast_app.css", cAlternateFileName="")) returned 1 [0029.916] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366b010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366d720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x221da, dwReserved0=0x63006d, dwReserved1=0x62006a, cFileName="cast_app.js", cAlternateFileName="")) returned 1 [0029.916] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366fe30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366fe30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x63006d, dwReserved1=0x62006a, cFileName="cast_app_redirect.js", cAlternateFileName="CAST_A~1.JS")) returned 1 [0029.916] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83674c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83674c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x63006d, dwReserved1=0x62006a, cFileName="chromecast_logo_grey.png", cAlternateFileName="CHROME~1.PNG")) returned 1 [0029.916] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 0x2020 [0029.917] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0029.917] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0029.917] ReadFile (in: hFile=0x110, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0x1000, lpOverlapped=0x0) returned 1 [0029.919] WriteFile (in: hFile=0x10c, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0x1000, lpOverlapped=0x0) returned 1 [0029.920] ReadFile (in: hFile=0x110, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0xbef, lpOverlapped=0x0) returned 1 [0029.921] WriteFile (in: hFile=0x10c, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0xbef, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0xbef, lpOverlapped=0x0) returned 1 [0029.921] ReadFile (in: hFile=0x110, lpBuffer=0x18c0b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18c0b8*, lpNumberOfBytesRead=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.921] WriteFile (in: hFile=0x10c, lpBuffer=0x18d0b8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18be04, lpOverlapped=0x0 | out: lpBuffer=0x18d0b8*, lpNumberOfBytesWritten=0x18be04*=0x0, lpOverlapped=0x0) returned 1 [0029.921] CloseHandle (hObject=0x110) returned 1 [0029.921] CloseHandle (hObject=0x10c) returned 1 [0029.922] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypt")) returned 0 [0029.922] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypt")) returned 0x2020 [0029.922] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83674c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83674c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x5d5010, dwReserved1=0x18e0cc, cFileName="chromecast_logo_grey.png", cAlternateFileName="CHROME~1.PNG")) returned 0x5c9080 [0029.922] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18df54 | out: lpFindFileData=0x18df54*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83674c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83674c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x5d5010, dwReserved1=0x18e0cc, cFileName="chromecast_logo_grey.png", cAlternateFileName="CHROME~1.PNG")) returned 0 [0029.922] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.922] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 1 [0029.923] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 0xffffffff [0029.923] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83679a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83679a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="devices.html", cAlternateFileName="DEVICE~1.HTM")) returned 1 [0029.923] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8367c180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8367c180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0029.923] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83685dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83685dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="offers.html", cAlternateFileName="OFFERS~1.HTM")) returned 1 [0029.923] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 1 [0029.923] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 0 [0029.923] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.923] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="cloud_route_details", cAlternateFileName="CLOUD_~1")) returned 1 [0029.923] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.925] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="..", cAlternateFileName="")) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8368fa00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368fa00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x174c, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="view.html", cAlternateFileName="VIEW~1.HTM")) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="view.js", cAlternateFileName="")) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="view.js", cAlternateFileName="")) returned 0 [0029.925] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83696f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83699640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="common.js", cAlternateFileName="")) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8369bd50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8369bd50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="feedback.css", cAlternateFileName="")) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a0b70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a0b70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x38a8, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="feedback.html", cAlternateFileName="FEEDBA~1.HTM")) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a5990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a5990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="feedback_script.js", cAlternateFileName="FEEDBA~1.JS")) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836af5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8395fd70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b1ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b43f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x46039, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="material_css_min.css", cAlternateFileName="MATERI~1.CSS")) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b6b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b9210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x7c33, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="mirroring_cast_streaming.js", cAlternateFileName="MIRROR~1.JS")) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836c2e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836c5560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2adeb, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="mirroring_common.js", cAlternateFileName="MIRROR~2.JS")) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836ca380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836cf1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x794cf, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="mirroring_hangouts.js", cAlternateFileName="MIRROR~3.JS")) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836d3fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836d66d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x941, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="mirroring_webrtc.js", cAlternateFileName="MIRROR~4.JS")) returned 1 [0029.925] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="_locales", cAlternateFileName="")) returned 1 [0029.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.927] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="..", cAlternateFileName="")) returned 1 [0029.927] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d4e98, dwReserved1=0x18e064, cFileName="am", cAlternateFileName="")) returned 1 [0029.927] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.928] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.928] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.928] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.928] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.928] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ar", cAlternateFileName="")) returned 1 [0029.928] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.928] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.929] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.929] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.929] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.929] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="bg", cAlternateFileName="")) returned 1 [0029.929] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.929] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.929] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.929] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.929] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.929] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="bn", cAlternateFileName="")) returned 1 [0029.929] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.930] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.930] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.930] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.930] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.930] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ca", cAlternateFileName="")) returned 1 [0029.930] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.931] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.931] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.931] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.931] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.931] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="cs", cAlternateFileName="")) returned 1 [0029.931] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.932] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.932] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.932] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.932] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.932] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="da", cAlternateFileName="")) returned 1 [0029.932] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.932] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.932] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.932] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.932] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.932] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="de", cAlternateFileName="")) returned 1 [0029.932] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.933] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.933] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.933] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.933] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.933] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="el", cAlternateFileName="")) returned 1 [0029.933] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.933] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.933] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.933] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.934] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.934] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="en", cAlternateFileName="")) returned 1 [0029.934] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.935] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.935] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.935] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.935] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.935] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="es", cAlternateFileName="")) returned 1 [0029.935] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.936] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.936] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.936] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.936] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.936] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="et", cAlternateFileName="")) returned 1 [0029.936] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.937] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.937] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.937] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.937] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.938] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="fa", cAlternateFileName="")) returned 1 [0029.938] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.939] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.939] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.939] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.939] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.939] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="fi", cAlternateFileName="")) returned 1 [0029.939] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.940] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.940] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.940] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.940] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.940] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="fil", cAlternateFileName="")) returned 1 [0029.940] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.940] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.940] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.940] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.940] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.940] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="fr", cAlternateFileName="")) returned 1 [0029.940] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.941] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.941] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.941] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.941] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.941] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="gu", cAlternateFileName="")) returned 1 [0029.941] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.941] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.941] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.941] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.941] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.942] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="hi", cAlternateFileName="")) returned 1 [0029.942] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.942] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.942] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.942] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.942] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.942] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="hr", cAlternateFileName="")) returned 1 [0029.943] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.943] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.943] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.943] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.943] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.943] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="hu", cAlternateFileName="")) returned 1 [0029.943] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.944] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.944] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.944] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.944] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.944] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="id", cAlternateFileName="")) returned 1 [0029.944] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.944] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.944] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.944] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.944] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.944] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="it", cAlternateFileName="")) returned 1 [0029.944] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.945] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.945] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.945] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.945] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.946] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="iw", cAlternateFileName="")) returned 1 [0029.946] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.946] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.946] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.946] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.946] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.946] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ja", cAlternateFileName="")) returned 1 [0029.946] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.947] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.947] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.947] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.947] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.947] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="kn", cAlternateFileName="")) returned 1 [0029.947] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.947] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.947] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.947] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.947] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.947] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ko", cAlternateFileName="")) returned 1 [0029.947] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.948] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.948] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.948] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.948] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.948] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="lt", cAlternateFileName="")) returned 1 [0029.948] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.948] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.949] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.949] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.949] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.949] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="lv", cAlternateFileName="")) returned 1 [0029.949] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.949] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.949] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.949] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.950] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.950] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ml", cAlternateFileName="")) returned 1 [0029.950] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.950] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.950] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.950] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.950] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.950] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="mr", cAlternateFileName="")) returned 1 [0029.950] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.951] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.951] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.951] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.951] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.951] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ms", cAlternateFileName="")) returned 1 [0029.951] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.951] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.951] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.951] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.951] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.951] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="nb", cAlternateFileName="")) returned 1 [0029.951] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.952] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.952] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.952] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.952] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.952] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="nl", cAlternateFileName="")) returned 1 [0029.952] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.953] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.953] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.953] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.953] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.953] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="pl", cAlternateFileName="")) returned 1 [0029.953] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.954] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.954] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.954] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.954] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.954] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="pt", cAlternateFileName="")) returned 1 [0029.954] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.954] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.954] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.954] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.954] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.954] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0029.954] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.955] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.955] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.955] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.955] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.955] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0029.955] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.955] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.955] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.955] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.955] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.956] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ro", cAlternateFileName="")) returned 1 [0029.956] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.956] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.956] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.956] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.957] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.957] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ru", cAlternateFileName="")) returned 1 [0029.957] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.957] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.957] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.957] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.957] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.957] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="sk", cAlternateFileName="")) returned 1 [0029.957] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.958] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.958] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.958] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.958] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.958] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="sl", cAlternateFileName="")) returned 1 [0029.958] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.958] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.958] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.958] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.958] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.958] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="sr", cAlternateFileName="")) returned 1 [0029.958] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.959] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.959] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.959] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.959] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.959] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="sv", cAlternateFileName="")) returned 1 [0029.959] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.960] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.960] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.960] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.960] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.960] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="sw", cAlternateFileName="")) returned 1 [0029.960] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.961] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.961] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.961] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.961] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.961] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="ta", cAlternateFileName="")) returned 1 [0029.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.961] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.961] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.961] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.961] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.961] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="te", cAlternateFileName="")) returned 1 [0029.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.962] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.962] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.962] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.962] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.962] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="th", cAlternateFileName="")) returned 1 [0029.962] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.963] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.963] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.963] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.963] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.963] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="tr", cAlternateFileName="")) returned 1 [0029.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.964] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.964] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.964] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.964] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.964] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="uk", cAlternateFileName="")) returned 1 [0029.964] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.964] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.964] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.964] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.964] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.964] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="vi", cAlternateFileName="")) returned 1 [0029.964] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.965] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.965] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.965] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.965] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.965] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="zh", cAlternateFileName="")) returned 1 [0029.965] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.965] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.965] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.965] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.966] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.966] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0029.966] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0029.966] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.966] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0029.966] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0029.967] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0029.967] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0029.967] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.967] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0029.967] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0029.967] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="..", cAlternateFileName="")) returned 1 [0029.967] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x839fe880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7299, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0029.967] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0029.968] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x5d6e6f, dwReserved1=0x18e064, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0029.968] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0029.968] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f676f6c, dwReserved1=0x6572675f, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0029.968] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0029.968] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64736e6f, dwReserved1=0x6a736a2e, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 0 [0029.968] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0029.968] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0 [0029.968] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.968] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80db2b00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Favicons", cAlternateFileName="")) returned 1 [0029.968] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80e97340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Favicons-journal", cAlternateFileName="FAVICO~1")) returned 1 [0029.968] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81c321d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81c321d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81c58330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2e9, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Google Profile.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1 [0029.968] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f47590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="History", cAlternateFileName="")) returned 1 [0029.968] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824d3190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824d3190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b6860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="History Provider Cache", cAlternateFileName="HISTOR~2")) returned 1 [0029.968] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f6d6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="History-journal", cAlternateFileName="HISTOR~1")) returned 1 [0029.968] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="JumpListIcons", cAlternateFileName="JUMPLI~2")) returned 1 [0029.968] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x305f35, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.969] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x305f35, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.969] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x305f35, dwReserved1=0x0, cFileName="A058.tmp", cAlternateFileName="")) returned 1 [0029.970] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x305f35, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.970] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x305f35, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74726265, dwReserved1=0x736a2e63, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0029.972] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0029.973] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.973] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.974] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.976] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.977] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74726265, dwReserved1=0x736a2e63, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0029.979] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0029.979] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.979] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0029.980] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74726265, dwReserved1=0x736a2e63, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0029.980] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0029.981] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0029.981] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.981] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.981] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.982] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.982] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.982] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.983] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.985] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.985] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.986] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.986] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0029.986] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0029.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0029.986] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0029.986] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0029.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x77163c74, cFileName="CrashReports", cAlternateFileName="\xf8\x5c\x5c")) returned 0xffffffff [0029.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x747358, dwReserved1=0x77163c74, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0029.986] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0029.987] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0029.987] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0029.988] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0029.988] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61747369, dwReserved1=0x696b746e, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0029.992] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0029.993] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0029.994] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0029.994] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0029.994] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0029.995] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0029.995] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0029.995] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0029.997] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0029.997] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 0x2026 [0029.998] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0029.998] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0029.998] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0029.999] WriteFile (in: hFile=0x100, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0030.000] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0030.000] WriteFile (in: hFile=0x100, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0030.000] CloseHandle (hObject=0xfc) returned 1 [0030.000] CloseHandle (hObject=0x100) returned 1 [0030.001] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.crypt")) returned 0 [0030.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.crypt")) returned 0x2020 [0030.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0030.001] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.001] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.001] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 1 [0030.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 0xffffffff [0030.002] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0030.002] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0030.002] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.002] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1 [0030.002] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.003] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0030.003] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 0x2026 [0030.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0030.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0030.003] ReadFile (in: hFile=0x100, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0030.004] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0030.005] ReadFile (in: hFile=0x100, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0030.005] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0030.005] CloseHandle (hObject=0x100) returned 1 [0030.005] CloseHandle (hObject=0xfc) returned 1 [0030.005] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.crypt")) returned 0 [0030.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.crypt")) returned 0x2020 [0030.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0030.006] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.006] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.006] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 1 [0030.007] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 0xffffffff [0030.007] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0030.007] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0030.007] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.007] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1 [0030.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.007] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0030.007] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.007] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 0x2026 [0030.008] VirtualAlloc (lpAddress=0x230000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x230000 [0030.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0030.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0030.009] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0030.009] WriteFile (in: hFile=0x100, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0030.010] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0030.010] WriteFile (in: hFile=0x100, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0030.010] CloseHandle (hObject=0xfc) returned 1 [0030.010] CloseHandle (hObject=0x100) returned 1 [0030.011] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.crypt")) returned 0 [0030.011] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.crypt")) returned 0x2020 [0030.011] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0030.011] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.011] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.011] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 1 [0030.012] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 0xffffffff [0030.012] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0030.012] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0030.012] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.012] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.012] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 0x2026 [0030.013] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.013] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0030.013] ReadFile (in: hFile=0xf8, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x43, lpOverlapped=0x0) returned 1 [0030.014] WriteFile (in: hFile=0x100, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x43, lpOverlapped=0x0) returned 1 [0030.015] ReadFile (in: hFile=0xf8, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0030.015] WriteFile (in: hFile=0x100, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0030.015] CloseHandle (hObject=0xf8) returned 1 [0030.015] CloseHandle (hObject=0x100) returned 1 [0030.015] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.crypt")) returned 0 [0030.015] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.crypt")) returned 0x2020 [0030.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cce70, dwReserved1=0x18ef3c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f00 [0030.015] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cce70, dwReserved1=0x18ef3c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.015] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.015] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 1 [0030.016] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 0xffffffff [0030.016] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="index.dat", cAlternateFileName="")) returned 1 [0030.016] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1 [0030.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.017] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.017] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.017] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 0x2026 [0030.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0030.019] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0030.020] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0030.021] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0030.021] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0030.021] CloseHandle (hObject=0xf8) returned 1 [0030.021] CloseHandle (hObject=0xfc) returned 1 [0030.021] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.crypt")) returned 0 [0030.022] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.crypt")) returned 0x2020 [0030.022] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0030.022] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.022] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.022] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 1 [0030.023] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 0xffffffff [0030.023] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0030.023] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1 [0030.023] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0 [0030.023] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.023] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0 [0030.023] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0030.023] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="FORMS", cAlternateFileName="")) returned 1 [0030.023] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0030.023] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="..", cAlternateFileName="")) returned 1 [0030.024] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1 [0030.024] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0 [0030.024] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0030.024] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="IME12", cAlternateFileName="")) returned 1 [0030.024] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0030.024] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="..", cAlternateFileName="")) returned 1 [0030.024] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="..", cAlternateFileName="")) returned 0 [0030.024] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0030.024] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0030.024] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0030.025] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="..", cAlternateFileName="")) returned 1 [0030.025] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="..", cAlternateFileName="")) returned 0 [0030.025] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0030.025] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0030.025] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0030.026] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="..", cAlternateFileName="")) returned 1 [0030.026] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="..", cAlternateFileName="")) returned 0 [0030.026] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0030.027] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0030.027] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0030.027] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="..", cAlternateFileName="")) returned 1 [0030.027] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="..", cAlternateFileName="")) returned 0 [0030.027] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0030.027] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0030.027] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0030.029] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="..", cAlternateFileName="")) returned 1 [0030.029] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="brndlog.bak", cAlternateFileName="")) returned 1 [0030.029] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x736f7263, dwReserved1=0x5b74666f, cFileName="brndlog.txt", cAlternateFileName="")) returned 1 [0030.029] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 0x2020 [0030.030] VirtualAlloc (lpAddress=0x234000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x234000 [0030.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0030.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0030.031] ReadFile (in: hFile=0x100, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0030.033] WriteFile (in: hFile=0xfc, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0030.033] ReadFile (in: hFile=0x100, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0030.034] WriteFile (in: hFile=0xfc, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0030.034] ReadFile (in: hFile=0x100, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0xfb0, lpOverlapped=0x0) returned 1 [0030.034] WriteFile (in: hFile=0xfc, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0xfb0, lpOverlapped=0x0) returned 1 [0030.034] ReadFile (in: hFile=0x100, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0030.034] WriteFile (in: hFile=0xfc, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0030.034] CloseHandle (hObject=0x100) returned 1 [0030.034] CloseHandle (hObject=0xfc) returned 1 [0030.035] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.crypt")) returned 0 [0030.035] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.crypt")) returned 0x2020 [0030.035] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x5cce70, dwReserved1=0x18ef3c, cFileName="brndlog.txt", cAlternateFileName="")) returned 0x5c8f00 [0030.036] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x5cce70, dwReserved1=0x18ef3c, cFileName="brndlog.txt", cAlternateFileName="")) returned 0 [0030.036] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.036] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 1 [0030.037] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 0xffffffff [0030.037] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0030.037] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.038] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.038] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1 [0030.038] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.038] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="..", cAlternateFileName="")) returned 1 [0030.038] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="..", cAlternateFileName="")) returned 0 [0030.038] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.038] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="8NES5H33", cAlternateFileName="")) returned 1 [0030.038] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.038] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="..", cAlternateFileName="")) returned 1 [0030.038] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 1 [0030.038] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 0 [0030.038] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.039] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e5d, dwReserved1=0x6c, cFileName="FKLUIDU0", cAlternateFileName="")) returned 1 [0030.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.039] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="..", cAlternateFileName="")) returned 1 [0030.039] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="..", cAlternateFileName="")) returned 0 [0030.039] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.039] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x6d782e5d, dwReserved1=0x6c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0030.039] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e5d, dwReserved1=0x6c, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1 [0030.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.039] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="..", cAlternateFileName="")) returned 1 [0030.039] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="..", cAlternateFileName="")) returned 0 [0030.039] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.040] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e5d, dwReserved1=0x6c, cFileName="OWLVMZRC", cAlternateFileName="")) returned 0 [0030.040] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.040] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1 [0030.040] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x95014270, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0030.040] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="Recovery", cAlternateFileName="")) returned 1 [0030.040] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e5d, dwReserved1=0x6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.040] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e5d, dwReserved1=0x6c, cFileName="..", cAlternateFileName="")) returned 1 [0030.040] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e5d, dwReserved1=0x6c, cFileName="Active", cAlternateFileName="")) returned 1 [0030.040] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.040] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="..", cAlternateFileName="")) returned 1 [0030.040] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="..", cAlternateFileName="")) returned 0 [0030.040] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.041] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e5d, dwReserved1=0x6c, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1 [0030.041] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.042] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="..", cAlternateFileName="")) returned 1 [0030.043] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 1 [0030.043] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6dd28c60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6dd28c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 1 [0030.043] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{4BD65~1.DAT")) returned 1 [0030.043] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 1 [0030.043] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x479f5aa3, dwReserved1=0x281f5e69, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 0 [0030.043] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.043] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e5d, dwReserved1=0x6c, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 0 [0030.043] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.043] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="Recovery", cAlternateFileName="")) returned 0 [0030.044] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0030.044] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656854, dwReserved1=0x42746164, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0030.044] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0030.045] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="..", cAlternateFileName="")) returned 1 [0030.045] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1 [0030.045] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1 [0030.045] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1 [0030.045] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d394638, dwReserved1=0x37453131, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.046] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d394638, dwReserved1=0x37453131, cFileName="..", cAlternateFileName="")) returned 1 [0030.046] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d394638, dwReserved1=0x37453131, cFileName="en-US", cAlternateFileName="")) returned 1 [0030.046] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.046] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.046] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0000E713", cAlternateFileName="")) returned 1 [0030.046] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1 [0030.048] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0030.048] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.049] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70772e6f, dwReserved1=0x6c70776c, cFileName="00010C6E", cAlternateFileName="")) returned 1 [0030.049] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0030.050] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.050] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0030.051] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1 [0030.051] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1 [0030.051] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1 [0030.051] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1 [0030.051] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1 [0030.051] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1 [0030.051] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1 [0030.051] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1 [0030.051] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1 [0030.051] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1 [0030.051] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1 [0030.051] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0030.051] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.052] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70772e6f, dwReserved1=0x6c70776c, cFileName="00010C6E", cAlternateFileName="")) returned 0 [0030.052] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.052] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d394638, dwReserved1=0x37453131, cFileName="en-US", cAlternateFileName="")) returned 0 [0030.052] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.052] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1 [0030.052] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d394638, dwReserved1=0x37453131, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.053] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d394638, dwReserved1=0x37453131, cFileName="..", cAlternateFileName="")) returned 1 [0030.053] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d394638, dwReserved1=0x37453131, cFileName="..", cAlternateFileName="")) returned 0 [0030.053] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.053] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 0 [0030.053] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0030.053] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6946, dwReserved1=0x61432073, cFileName="Office", cAlternateFileName="")) returned 1 [0030.053] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0030.053] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="..", cAlternateFileName="")) returned 1 [0030.053] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8da8, dwReserved1=0x18eed4, cFileName="14.0", cAlternateFileName="")) returned 1 [0030.053] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d394638, dwReserved1=0x37453131, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.057] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d394638, dwReserved1=0x37453131, cFileName="..", cAlternateFileName="")) returned 1 [0030.057] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d394638, dwReserved1=0x37453131, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1 [0030.057] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.057] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.058] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSD-CNRY.FSD", cAlternateFileName="")) returned 1 [0030.058] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", cAlternateFileName="FSD-{4~1.FSD")) returned 1 [0030.058] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 1 [0030.058] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 0 [0030.058] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.058] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d394638, dwReserved1=0x37453131, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 0 [0030.058] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.058] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65686361, dwReserved1=0x18eed4, cFileName="Groove", cAlternateFileName="")) returned 1 [0030.058] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.058] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0030.058] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="System", cAlternateFileName="")) returned 1 [0030.058] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.058] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.058] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.058] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.058] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="User", cAlternateFileName="")) returned 1 [0030.059] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.059] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.059] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0030.059] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.059] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="User", cAlternateFileName="")) returned 0 [0030.059] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.059] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65686361, dwReserved1=0x18eed4, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1 [0030.059] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.059] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0030.059] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 1 [0030.059] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 1 [0030.059] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 0 [0030.059] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.059] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65686361, dwReserved1=0x18eed4, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 0 [0030.059] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0030.059] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6946, dwReserved1=0x61432073, cFileName="Outlook", cAlternateFileName="")) returned 1 [0030.060] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34396462, dwReserved1=0x31613262, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0030.060] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34396462, dwReserved1=0x31613262, cFileName="..", cAlternateFileName="")) returned 1 [0030.060] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x34396462, dwReserved1=0x31613262, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1 [0030.060] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4d2d00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x34396462, dwReserved1=0x31613262, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 1 [0030.060] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34396462, dwReserved1=0x31613262, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1 [0030.060] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.060] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0030.060] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0030.060] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0030.060] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.060] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34396462, dwReserved1=0x31613262, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 0 [0030.061] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0030.061] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6972, dwReserved1=0x6c6d782e, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0030.061] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0030.062] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 1 [0030.062] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 0 [0030.062] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0030.062] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6972, dwReserved1=0x6c6d782e, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1 [0030.062] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0030.063] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 1 [0030.063] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 0 [0030.063] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0030.063] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6972, dwReserved1=0x6c6d782e, cFileName="Visio", cAlternateFileName="")) returned 1 [0030.063] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0030.063] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 1 [0030.063] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1 [0030.063] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="thumbs.dat", cAlternateFileName="")) returned 1 [0030.063] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="thumbs.dat", cAlternateFileName="")) returned 0 [0030.063] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0030.064] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e7461, dwReserved1=0x6c6d782e, cFileName="Windows", cAlternateFileName="")) returned 1 [0030.064] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0030.064] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="..", cAlternateFileName="")) returned 1 [0030.064] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="1024", cAlternateFileName="")) returned 1 [0030.064] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.065] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0030.065] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 0 [0030.065] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.065] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50746361, dwReserved1=0x73666572, cFileName="1033", cAlternateFileName="")) returned 1 [0030.065] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.066] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0030.066] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1 [0030.066] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0 [0030.066] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.066] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x79726575, dwReserved1=0x65686353, cFileName="Burn", cAlternateFileName="")) returned 1 [0030.066] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.066] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0030.066] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="Burn", cAlternateFileName="")) returned 1 [0030.066] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.066] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.066] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.066] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 0x26 [0030.067] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.067] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0030.068] ReadFile (in: hFile=0xf8, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xae, lpOverlapped=0x0) returned 1 [0030.069] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xae, lpOverlapped=0x0) returned 1 [0030.069] ReadFile (in: hFile=0xf8, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0030.069] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0030.070] CloseHandle (hObject=0xf8) returned 1 [0030.070] CloseHandle (hObject=0x104) returned 1 [0030.071] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.crypt")) returned 0 [0030.071] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.crypt")) returned 0x20 [0030.071] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5d0e80, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0030.071] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5d0e80, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.071] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.071] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 1 [0030.072] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 0xffffffff [0030.072] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.072] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.072] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="Burn1", cAlternateFileName="")) returned 1 [0030.072] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.073] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0030.073] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.073] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini")) returned 0x6 [0030.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0030.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.074] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xae, lpOverlapped=0x0) returned 1 [0030.074] WriteFile (in: hFile=0xf8, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xae, lpOverlapped=0x0) returned 1 [0030.075] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0030.075] WriteFile (in: hFile=0xf8, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0030.075] CloseHandle (hObject=0x104) returned 1 [0030.075] CloseHandle (hObject=0xf8) returned 1 [0030.075] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.crypt")) returned 0 [0030.076] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.crypt")) returned 0x20 [0030.076] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5d0e80, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0030.076] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5d0e80, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.076] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.076] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini")) returned 1 [0030.077] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini")) returned 0xffffffff [0030.077] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.077] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.077] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="Burn2", cAlternateFileName="")) returned 1 [0030.077] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.078] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0030.078] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.079] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini")) returned 0x6 [0030.079] VirtualAlloc (lpAddress=0x238000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x238000 [0030.080] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.080] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0030.080] ReadFile (in: hFile=0xf8, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xae, lpOverlapped=0x0) returned 1 [0030.081] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xae, lpOverlapped=0x0) returned 1 [0030.082] ReadFile (in: hFile=0xf8, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0030.082] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0030.082] CloseHandle (hObject=0xf8) returned 1 [0030.082] CloseHandle (hObject=0x104) returned 1 [0030.082] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini.crypt")) returned 0 [0030.083] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini.crypt")) returned 0x20 [0030.083] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5d0e80, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0030.083] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5d0e80, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.083] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.083] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini")) returned 1 [0030.084] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini")) returned 0xffffffff [0030.084] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.084] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.084] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="Burn2", cAlternateFileName="")) returned 0 [0030.084] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.084] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x79726575, dwReserved1=0x65686353, cFileName="Caches", cAlternateFileName="")) returned 1 [0030.084] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.084] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0030.084] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1 [0030.084] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x408bd0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x408bd0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x408bd0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x18388, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", cAlternateFileName="{AFBF9~3.DB")) returned 1 [0030.084] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 1 [0030.084] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 0 [0030.085] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.085] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d384545, dwReserved1=0x37374334, cFileName="Explorer", cAlternateFileName="")) returned 1 [0030.085] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.085] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0030.085] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1 [0030.085] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x841d6620, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1 [0030.085] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1 [0030.085] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 1 [0030.085] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 1 [0030.085] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x962e8480, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1 [0030.085] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 1 [0030.085] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 1 [0030.085] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 0 [0030.085] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.085] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0030.085] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.086] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0030.086] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 0 [0030.086] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.086] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="History", cAlternateFileName="")) returned 1 [0030.086] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.086] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="..", cAlternateFileName="")) returned 1 [0030.086] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x452d3346, dwReserved1=0x2d373643, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 0x2026 [0030.086] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0030.087] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0030.087] ReadFile (in: hFile=0x100, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x91, lpOverlapped=0x0) returned 1 [0030.087] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x91, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x91, lpOverlapped=0x0) returned 1 [0030.088] ReadFile (in: hFile=0x100, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0030.088] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0030.088] CloseHandle (hObject=0x100) returned 1 [0030.088] CloseHandle (hObject=0x104) returned 1 [0030.089] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.crypt")) returned 0 [0030.089] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.crypt")) returned 0x2020 [0030.089] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5cce70, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0030.090] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5cce70, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.090] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.090] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 1 [0030.090] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 0xffffffff [0030.091] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96a327e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96a327e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0030.091] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96a327e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96a327e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.091] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x96a327e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96a327e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.091] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.091] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 0x2026 [0030.093] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0030.093] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.093] ReadFile (in: hFile=0x100, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x91, lpOverlapped=0x0) returned 1 [0030.094] WriteFile (in: hFile=0xf8, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x91, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x91, lpOverlapped=0x0) returned 1 [0030.095] ReadFile (in: hFile=0x100, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0030.095] WriteFile (in: hFile=0xf8, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0030.095] CloseHandle (hObject=0x100) returned 1 [0030.095] CloseHandle (hObject=0xf8) returned 1 [0030.095] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.crypt")) returned 0 [0030.095] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.crypt")) returned 0x2020 [0030.095] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5cde78, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0030.095] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5cde78, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.096] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.096] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 1 [0030.096] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 0xffffffff [0030.097] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x9b4223a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x5d5e90, dwReserved1=0x18ea04, cFileName="index.dat", cAlternateFileName="")) returned 1 [0030.097] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96a327e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96a327e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96a327e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e90, dwReserved1=0x18ea04, cFileName="MSHist012019071920190720", cAlternateFileName="MSHIST~1")) returned 1 [0030.097] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019071920190720\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96a327e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96a327e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96a327e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0030.097] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96a327e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96a327e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96a327e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.097] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x96a327e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96a327e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0030.097] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x96a327e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96a327e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0030.097] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.097] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96a327e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96a327e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96a327e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e90, dwReserved1=0x18ea04, cFileName="MSHist012019071920190720", cAlternateFileName="MSHIST~1")) returned 0 [0030.097] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.097] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName="Low", cAlternateFileName="")) returned 1 [0030.097] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e90, dwReserved1=0x18ea04, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.097] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e90, dwReserved1=0x18ea04, cFileName="..", cAlternateFileName="")) returned 1 [0030.097] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5d5e90, dwReserved1=0x18ea04, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini")) returned 0x2006 [0030.098] VirtualAlloc (lpAddress=0x23c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x23c000 [0030.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.099] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0030.099] ReadFile (in: hFile=0xf8, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x91, lpOverlapped=0x0) returned 1 [0030.100] WriteFile (in: hFile=0x100, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x91, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x91, lpOverlapped=0x0) returned 1 [0030.100] ReadFile (in: hFile=0xf8, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0030.100] WriteFile (in: hFile=0x100, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0030.100] CloseHandle (hObject=0xf8) returned 1 [0030.101] CloseHandle (hObject=0x100) returned 1 [0030.101] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini.crypt")) returned 0 [0030.102] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini.crypt")) returned 0x2020 [0030.102] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5cde78, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0030.102] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5cde78, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.102] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.102] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini")) returned 1 [0030.103] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini")) returned 0xffffffff [0030.103] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0030.103] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0030.103] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.103] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.103] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini")) returned 0x2006 [0030.103] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.104] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0030.105] ReadFile (in: hFile=0xf8, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x91, lpOverlapped=0x0) returned 1 [0030.106] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x91, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x91, lpOverlapped=0x0) returned 1 [0030.107] ReadFile (in: hFile=0xf8, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0030.107] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0030.107] CloseHandle (hObject=0xf8) returned 1 [0030.107] CloseHandle (hObject=0x108) returned 1 [0030.107] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini.crypt")) returned 0 [0030.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini.crypt")) returned 0x2020 [0030.108] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5d5f70, dwReserved1=0x18e804, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8fc0 [0030.108] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5d5f70, dwReserved1=0x18e804, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.108] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0030.108] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini")) returned 1 [0030.109] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini")) returned 0xffffffff [0030.109] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x5d5e90, dwReserved1=0x18e79c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0030.109] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e90, dwReserved1=0x18e79c, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1 [0030.109] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0030.109] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.109] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0030.109] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0030.109] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0030.109] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e90, dwReserved1=0x18e79c, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 0 [0030.109] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.109] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0030.109] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.109] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName="Low", cAlternateFileName="")) returned 0 [0030.109] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.109] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0030.109] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.110] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName="..", cAlternateFileName="")) returned 1 [0030.110] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName="..", cAlternateFileName="")) returned 0 [0030.110] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0030.110] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0030.110] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0030.110] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName="..", cAlternateFileName="")) returned 1 [0030.110] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0030.110] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373037, dwReserved1=0x31303232, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.111] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373037, dwReserved1=0x31303232, cFileName="..", cAlternateFileName="")) returned 1 [0030.111] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x31373037, dwReserved1=0x31303232, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.111] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 0x2026 [0030.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0030.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0030.112] ReadFile (in: hFile=0x100, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0030.113] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0030.114] ReadFile (in: hFile=0x100, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0030.114] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0030.114] CloseHandle (hObject=0x100) returned 1 [0030.114] CloseHandle (hObject=0x108) returned 1 [0030.114] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.crypt")) returned 0 [0030.114] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.crypt")) returned 0x2020 [0030.114] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cce70, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0030.114] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cce70, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.114] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.114] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 1 [0030.115] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 0xffffffff [0030.115] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x9b4223a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="index.dat", cAlternateFileName="")) returned 1 [0030.115] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1 [0030.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0030.117] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.117] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 0x2026 [0030.118] VirtualAlloc (lpAddress=0x240000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x240000 [0030.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0030.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.118] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0030.121] WriteFile (in: hFile=0xf8, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0030.122] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0030.122] WriteFile (in: hFile=0xf8, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0030.122] CloseHandle (hObject=0x100) returned 1 [0030.122] CloseHandle (hObject=0xf8) returned 1 [0030.123] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.crypt")) returned 0 [0030.123] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.crypt")) returned 0x2020 [0030.123] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18e804, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8fc0 [0030.123] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18e804, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.123] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0030.123] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 1 [0030.124] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 0xffffffff [0030.124] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.124] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.124] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1 [0030.124] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0030.126] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="..", cAlternateFileName="")) returned 1 [0030.126] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.126] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 0x2026 [0030.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.127] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0030.127] ReadFile (in: hFile=0xf8, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0030.128] WriteFile (in: hFile=0x100, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0030.128] ReadFile (in: hFile=0xf8, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0030.128] WriteFile (in: hFile=0x100, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0030.129] CloseHandle (hObject=0xf8) returned 1 [0030.129] CloseHandle (hObject=0x100) returned 1 [0030.129] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.crypt")) returned 0 [0030.129] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.crypt")) returned 0x2020 [0030.129] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18e804, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8fc0 [0030.129] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18e804, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.129] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0030.129] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 1 [0030.130] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 0xffffffff [0030.130] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.130] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.130] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1 [0030.130] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0030.132] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="..", cAlternateFileName="")) returned 1 [0030.133] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 0x2026 [0030.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0030.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.133] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0030.134] WriteFile (in: hFile=0xf8, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0030.135] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0030.135] WriteFile (in: hFile=0xf8, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0030.135] CloseHandle (hObject=0x100) returned 1 [0030.135] CloseHandle (hObject=0xf8) returned 1 [0030.135] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.crypt")) returned 0 [0030.135] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.crypt")) returned 0x2020 [0030.135] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18e804, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8fc0 [0030.136] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18e804, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.136] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0030.136] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 1 [0030.137] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 0xffffffff [0030.137] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.137] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.137] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="X9OHK109", cAlternateFileName="")) returned 1 [0030.137] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0030.139] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="..", cAlternateFileName="")) returned 1 [0030.139] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 0x2026 [0030.139] VirtualAlloc (lpAddress=0x244000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x244000 [0030.139] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.139] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0030.139] ReadFile (in: hFile=0xf8, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0030.140] WriteFile (in: hFile=0x100, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0030.141] ReadFile (in: hFile=0xf8, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0030.141] WriteFile (in: hFile=0x100, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0030.141] CloseHandle (hObject=0xf8) returned 1 [0030.141] CloseHandle (hObject=0x100) returned 1 [0030.142] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.crypt")) returned 0 [0030.142] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.crypt")) returned 0x2020 [0030.142] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18e804, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8fc0 [0030.142] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cde78, dwReserved1=0x18e804, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.142] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0030.142] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 1 [0030.143] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 0xffffffff [0030.143] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.143] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.143] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="X9OHK109", cAlternateFileName="")) returned 0 [0030.143] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.143] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName="Content.MSO", cAlternateFileName="")) returned 1 [0030.143] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.144] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="..", cAlternateFileName="")) returned 1 [0030.144] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="..", cAlternateFileName="")) returned 0 [0030.144] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.144] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27b4c650, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1 [0030.144] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.145] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="..", cAlternateFileName="")) returned 1 [0030.145] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="..", cAlternateFileName="")) returned 0 [0030.145] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.145] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.145] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 0x2026 [0030.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0030.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0030.146] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0030.147] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0030.148] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0030.148] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0030.148] CloseHandle (hObject=0x104) returned 1 [0030.148] CloseHandle (hObject=0x108) returned 1 [0030.148] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.crypt")) returned 0 [0030.149] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.crypt")) returned 0x2020 [0030.149] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d5f78, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0030.149] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d5f78, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.149] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0030.149] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 1 [0030.150] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 0xffffffff [0030.150] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e90, dwReserved1=0x18ec6c, cFileName="Low", cAlternateFileName="")) returned 1 [0030.150] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0030.150] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.150] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="AntiPhishing", cAlternateFileName="ANTIPH~1")) returned 1 [0030.150] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0030.151] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="..", cAlternateFileName="")) returned 1 [0030.151] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 1 [0030.151] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 0 [0030.151] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0030.151] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3841, dwReserved1=0x2d414133, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0030.151] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0030.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="..", cAlternateFileName="")) returned 1 [0030.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e79c, cFileName="9QH4S0GZ", cAlternateFileName="")) returned 1 [0030.152] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0030.154] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0030.155] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdbb73b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdbb73b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdc03670, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x39d41, dwReserved0=0x0, dwReserved1=0x0, cFileName="28-8f3193-f30905ea[1]", cAlternateFileName="28-8F3~1")) returned 1 [0030.155] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5529b670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x0, dwReserved1=0x0, cFileName="528d82a2[1].js", cAlternateFileName="528D82~1.JS")) returned 1 [0030.155] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x0, dwReserved1=0x0, cFileName="AA3e3XC[2].png", cAlternateFileName="AA3E3X~2.PNG")) returned 1 [0030.155] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png")) returned 0x2020 [0030.156] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.156] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.156] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x135, lpOverlapped=0x0) returned 1 [0030.157] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x135, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x135, lpOverlapped=0x0) returned 1 [0030.158] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.158] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.158] CloseHandle (hObject=0xf8) returned 1 [0030.158] CloseHandle (hObject=0x114) returned 1 [0030.159] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png.crypt")) returned 0 [0030.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png.crypt")) returned 0x2020 [0030.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA3e3XC[2].png", cAlternateFileName="AA3E3X~2.PNG")) returned 0x5c9000 [0030.159] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA3e3XC[2].png", cAlternateFileName="AA3E3X~2.PNG")) returned 0 [0030.160] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.160] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png")) returned 1 [0030.160] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png")) returned 0xffffffff [0030.161] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA3vOVA[1].png", cAlternateFileName="AA3VOV~1.PNG")) returned 1 [0030.161] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png")) returned 0x2020 [0030.161] VirtualAlloc (lpAddress=0x248000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x248000 [0030.162] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.162] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.162] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x28e, lpOverlapped=0x0) returned 1 [0030.163] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x28e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x28e, lpOverlapped=0x0) returned 1 [0030.164] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.164] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.164] CloseHandle (hObject=0x114) returned 1 [0030.165] CloseHandle (hObject=0xf8) returned 1 [0030.165] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png.crypt")) returned 0 [0030.165] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png.crypt")) returned 0x2020 [0030.165] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA3vOVA[1].png", cAlternateFileName="AA3VOV~1.PNG")) returned 0x5c9000 [0030.166] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA3vOVA[1].png", cAlternateFileName="AA3VOV~1.PNG")) returned 0 [0030.166] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.166] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png")) returned 1 [0030.167] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png")) returned 0xffffffff [0030.167] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA42EP9[1].png", cAlternateFileName="AA42EP~1.PNG")) returned 1 [0030.167] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png")) returned 0x2020 [0030.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.167] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1cd, lpOverlapped=0x0) returned 1 [0030.169] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1cd, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1cd, lpOverlapped=0x0) returned 1 [0030.170] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.170] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.170] CloseHandle (hObject=0xf8) returned 1 [0030.170] CloseHandle (hObject=0x114) returned 1 [0030.170] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png.crypt")) returned 0 [0030.171] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png.crypt")) returned 0x2020 [0030.171] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA42EP9[1].png", cAlternateFileName="AA42EP~1.PNG")) returned 0x5c9000 [0030.171] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA42EP9[1].png", cAlternateFileName="AA42EP~1.PNG")) returned 0 [0030.171] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.171] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png")) returned 1 [0030.172] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png")) returned 0xffffffff [0030.172] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA54rQj[1].png", cAlternateFileName="AA54RQ~1.PNG")) returned 1 [0030.172] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png")) returned 0x2020 [0030.172] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.172] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.172] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x191, lpOverlapped=0x0) returned 1 [0030.174] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x191, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x191, lpOverlapped=0x0) returned 1 [0030.174] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.175] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.175] CloseHandle (hObject=0x114) returned 1 [0030.175] CloseHandle (hObject=0xf8) returned 1 [0030.175] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png.crypt")) returned 0 [0030.176] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png.crypt")) returned 0x2020 [0030.176] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA54rQj[1].png", cAlternateFileName="AA54RQ~1.PNG")) returned 0x5c9000 [0030.176] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA54rQj[1].png", cAlternateFileName="AA54RQ~1.PNG")) returned 0 [0030.176] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.176] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png")) returned 1 [0030.177] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png")) returned 0xffffffff [0030.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA61yi9[1].png", cAlternateFileName="AA61YI~1.PNG")) returned 1 [0030.177] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png")) returned 0x2020 [0030.177] VirtualAlloc (lpAddress=0x24c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x24c000 [0030.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.178] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x19d, lpOverlapped=0x0) returned 1 [0030.179] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x19d, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x19d, lpOverlapped=0x0) returned 1 [0030.180] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.180] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.180] CloseHandle (hObject=0xf8) returned 1 [0030.181] CloseHandle (hObject=0x114) returned 1 [0030.181] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png.crypt")) returned 0 [0030.181] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png.crypt")) returned 0x2020 [0030.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA61yi9[1].png", cAlternateFileName="AA61YI~1.PNG")) returned 0x5c9000 [0030.182] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA61yi9[1].png", cAlternateFileName="AA61YI~1.PNG")) returned 0 [0030.182] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.182] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png")) returned 1 [0030.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png")) returned 0xffffffff [0030.183] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA8uCo4[1].png", cAlternateFileName="AA8UCO~1.PNG")) returned 1 [0030.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png")) returned 0x2020 [0030.184] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.184] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.184] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2c8, lpOverlapped=0x0) returned 1 [0030.187] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2c8, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2c8, lpOverlapped=0x0) returned 1 [0030.188] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.188] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.188] CloseHandle (hObject=0x114) returned 1 [0030.188] CloseHandle (hObject=0xf8) returned 1 [0030.189] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png.crypt")) returned 0 [0030.189] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png.crypt")) returned 0x2020 [0030.189] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA8uCo4[1].png", cAlternateFileName="AA8UCO~1.PNG")) returned 0x5c9000 [0030.189] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA8uCo4[1].png", cAlternateFileName="AA8UCO~1.PNG")) returned 0 [0030.189] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.189] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png")) returned 1 [0030.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png")) returned 0xffffffff [0030.190] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAdAVrM[1].png", cAlternateFileName="AADAVR~1.PNG")) returned 1 [0030.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png")) returned 0x2020 [0030.191] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.191] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.191] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x342, lpOverlapped=0x0) returned 1 [0030.193] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x342, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x342, lpOverlapped=0x0) returned 1 [0030.194] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.194] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.194] CloseHandle (hObject=0xf8) returned 1 [0030.194] CloseHandle (hObject=0x114) returned 1 [0030.195] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png.crypt")) returned 0 [0030.195] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png.crypt")) returned 0x2020 [0030.195] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAdAVrM[1].png", cAlternateFileName="AADAVR~1.PNG")) returned 0x5c9000 [0030.195] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAdAVrM[1].png", cAlternateFileName="AADAVR~1.PNG")) returned 0 [0030.195] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.195] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png")) returned 1 [0030.196] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png")) returned 0xffffffff [0030.196] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4697f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4697f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4b5ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e7, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="adServer[1].htm", cAlternateFileName="ADSERV~1.HTM")) returned 1 [0030.196] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="advertisement.ad[1].js", cAlternateFileName="ADVERT~1.JS")) returned 1 [0030.196] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x545d0030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545d0030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x545d0030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1 [0030.196] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x534, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="async_usersync[2]", cAlternateFileName="ASYNC_~2")) returned 1 [0030.196] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="async_usersync[3]", cAlternateFileName="ASYNC_~3")) returned 1 [0030.196] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BB1CcOi[1].png", cAlternateFileName="BB1CCO~1.PNG")) returned 1 [0030.196] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png")) returned 0x2020 [0030.197] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.197] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.197] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1d0, lpOverlapped=0x0) returned 1 [0030.198] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1d0, lpOverlapped=0x0) returned 1 [0030.199] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.199] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.199] CloseHandle (hObject=0x114) returned 1 [0030.199] CloseHandle (hObject=0xf8) returned 1 [0030.200] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png.crypt")) returned 0 [0030.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png.crypt")) returned 0x2020 [0030.201] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB1CcOi[1].png", cAlternateFileName="BB1CCO~1.PNG")) returned 0x5c9000 [0030.201] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB1CcOi[1].png", cAlternateFileName="BB1CCO~1.PNG")) returned 0 [0030.201] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.201] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png")) returned 1 [0030.202] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png")) returned 0xffffffff [0030.202] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BB46JmN[1].png", cAlternateFileName="BB46JM~1.PNG")) returned 1 [0030.202] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png")) returned 0x2020 [0030.202] VirtualAlloc (lpAddress=0x250000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x250000 [0030.203] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.203] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.206] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x310, lpOverlapped=0x0) returned 1 [0030.207] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x310, lpOverlapped=0x0) returned 1 [0030.208] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.208] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.208] CloseHandle (hObject=0xf8) returned 1 [0030.208] CloseHandle (hObject=0x114) returned 1 [0030.209] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png.crypt")) returned 0 [0030.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png.crypt")) returned 0x2020 [0030.209] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB46JmN[1].png", cAlternateFileName="BB46JM~1.PNG")) returned 0x5c9000 [0030.209] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB46JmN[1].png", cAlternateFileName="BB46JM~1.PNG")) returned 0 [0030.209] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.209] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png")) returned 1 [0030.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png")) returned 0xffffffff [0030.210] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BB5kJAC[1].png", cAlternateFileName="BB5KJA~1.PNG")) returned 1 [0030.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png")) returned 0x2020 [0030.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.211] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x120, lpOverlapped=0x0) returned 1 [0030.213] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x120, lpOverlapped=0x0) returned 1 [0030.213] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.214] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.214] CloseHandle (hObject=0x114) returned 1 [0030.214] CloseHandle (hObject=0xf8) returned 1 [0030.214] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png.crypt")) returned 0 [0030.215] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png.crypt")) returned 0x2020 [0030.215] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB5kJAC[1].png", cAlternateFileName="BB5KJA~1.PNG")) returned 0x5c9000 [0030.215] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB5kJAC[1].png", cAlternateFileName="BB5KJA~1.PNG")) returned 0 [0030.215] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.215] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png")) returned 1 [0030.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png")) returned 0xffffffff [0030.216] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BB5kTiV[1].png", cAlternateFileName="BB5KTI~1.PNG")) returned 1 [0030.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png")) returned 0x2020 [0030.217] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.217] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.217] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x121, lpOverlapped=0x0) returned 1 [0030.219] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x121, lpOverlapped=0x0) returned 1 [0030.220] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.220] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.220] CloseHandle (hObject=0xf8) returned 1 [0030.220] CloseHandle (hObject=0x114) returned 1 [0030.220] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png.crypt")) returned 0 [0030.221] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png.crypt")) returned 0x2020 [0030.221] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB5kTiV[1].png", cAlternateFileName="BB5KTI~1.PNG")) returned 0x5c9000 [0030.221] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB5kTiV[1].png", cAlternateFileName="BB5KTI~1.PNG")) returned 0 [0030.221] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.221] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png")) returned 1 [0030.222] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png")) returned 0xffffffff [0030.222] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BB6Ma4a[1].png", cAlternateFileName="BB6MA4~1.PNG")) returned 1 [0030.222] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png")) returned 0x2020 [0030.222] VirtualAlloc (lpAddress=0x254000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x254000 [0030.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.223] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.223] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x18c, lpOverlapped=0x0) returned 1 [0030.224] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x18c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x18c, lpOverlapped=0x0) returned 1 [0030.225] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.225] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.225] CloseHandle (hObject=0x114) returned 1 [0030.225] CloseHandle (hObject=0xf8) returned 1 [0030.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png.crypt")) returned 0 [0030.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png.crypt")) returned 0x2020 [0030.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB6Ma4a[1].png", cAlternateFileName="BB6MA4~1.PNG")) returned 0x5c9000 [0030.227] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB6Ma4a[1].png", cAlternateFileName="BB6MA4~1.PNG")) returned 0 [0030.227] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png")) returned 1 [0030.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png")) returned 0xffffffff [0030.228] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BB74fLs[1].png", cAlternateFileName="BB74FL~1.PNG")) returned 1 [0030.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png")) returned 0x2020 [0030.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.229] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x168, lpOverlapped=0x0) returned 1 [0030.231] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x168, lpOverlapped=0x0) returned 1 [0030.231] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.231] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.231] CloseHandle (hObject=0xf8) returned 1 [0030.232] CloseHandle (hObject=0x114) returned 1 [0030.232] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png.crypt")) returned 0 [0030.233] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png.crypt")) returned 0x2020 [0030.233] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB74fLs[1].png", cAlternateFileName="BB74FL~1.PNG")) returned 0x5c9000 [0030.233] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB74fLs[1].png", cAlternateFileName="BB74FL~1.PNG")) returned 0 [0030.233] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.233] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png")) returned 1 [0030.234] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png")) returned 0xffffffff [0030.234] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x333f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBIqq8[1].jpg", cAlternateFileName="BBBIQQ~1.JPG")) returned 1 [0030.234] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg")) returned 0x2020 [0030.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.235] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.237] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.238] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.238] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.238] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.238] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.238] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x33f, lpOverlapped=0x0) returned 1 [0030.238] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x33f, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x33f, lpOverlapped=0x0) returned 1 [0030.239] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.239] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.239] CloseHandle (hObject=0x114) returned 1 [0030.239] CloseHandle (hObject=0xf8) returned 1 [0030.240] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.crypt")) returned 0 [0030.240] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.crypt")) returned 0x2020 [0030.240] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x333f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBIqq8[1].jpg", cAlternateFileName="BBBIQQ~1.JPG")) returned 0x5c9000 [0030.240] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x333f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBIqq8[1].jpg", cAlternateFileName="BBBIQQ~1.JPG")) returned 0 [0030.240] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.240] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg")) returned 1 [0030.241] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg")) returned 0xffffffff [0030.241] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBL0ij[1].jpg", cAlternateFileName="BBBL0I~1.JPG")) returned 1 [0030.241] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg")) returned 0x2020 [0030.242] VirtualAlloc (lpAddress=0x258000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x258000 [0030.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.243] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x90b, lpOverlapped=0x0) returned 1 [0030.244] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x90b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x90b, lpOverlapped=0x0) returned 1 [0030.245] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.245] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.245] CloseHandle (hObject=0xf8) returned 1 [0030.245] CloseHandle (hObject=0x114) returned 1 [0030.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.crypt")) returned 0 [0030.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.crypt")) returned 0x2020 [0030.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBL0ij[1].jpg", cAlternateFileName="BBBL0I~1.JPG")) returned 0x5c9000 [0030.246] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBL0ij[1].jpg", cAlternateFileName="BBBL0I~1.JPG")) returned 0 [0030.246] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.246] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg")) returned 1 [0030.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg")) returned 0xffffffff [0030.247] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53630fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53630fd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBLhZX[1].jpg", cAlternateFileName="BBBLHZ~1.JPG")) returned 1 [0030.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg")) returned 0x2020 [0030.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.248] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x994, lpOverlapped=0x0) returned 1 [0030.255] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x994, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x994, lpOverlapped=0x0) returned 1 [0030.269] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.269] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.269] CloseHandle (hObject=0x114) returned 1 [0030.269] CloseHandle (hObject=0xf8) returned 1 [0030.270] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.crypt")) returned 0 [0030.270] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.crypt")) returned 0x2020 [0030.270] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53630fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53630fd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBLhZX[1].jpg", cAlternateFileName="BBBLHZ~1.JPG")) returned 0x5c9000 [0030.271] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53630fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53630fd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBLhZX[1].jpg", cAlternateFileName="BBBLHZ~1.JPG")) returned 0 [0030.271] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.271] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg")) returned 1 [0030.272] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg")) returned 0xffffffff [0030.272] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53467f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28b9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBNiEo[1].jpg", cAlternateFileName="BBBNIE~1.JPG")) returned 1 [0030.272] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg")) returned 0x2020 [0030.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.273] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.275] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.275] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.276] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.276] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x8b9, lpOverlapped=0x0) returned 1 [0030.276] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x8b9, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x8b9, lpOverlapped=0x0) returned 1 [0030.276] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.276] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.276] CloseHandle (hObject=0xf8) returned 1 [0030.276] CloseHandle (hObject=0x114) returned 1 [0030.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.crypt")) returned 0 [0030.277] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.crypt")) returned 0x2020 [0030.277] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53467f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28b9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBNiEo[1].jpg", cAlternateFileName="BBBNIE~1.JPG")) returned 0x5c9000 [0030.277] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53467f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28b9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBNiEo[1].jpg", cAlternateFileName="BBBNIE~1.JPG")) returned 0 [0030.277] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.278] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg")) returned 1 [0030.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg")) returned 0xffffffff [0030.278] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b65ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b65ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x176d, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 1 [0030.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg")) returned 0x2020 [0030.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.280] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.282] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.282] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x76d, lpOverlapped=0x0) returned 1 [0030.283] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x76d, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x76d, lpOverlapped=0x0) returned 1 [0030.283] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.283] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.283] CloseHandle (hObject=0x114) returned 1 [0030.283] CloseHandle (hObject=0xf8) returned 1 [0030.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.crypt")) returned 0 [0030.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.crypt")) returned 0x2020 [0030.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b65ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b65ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x176d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 0x5c9000 [0030.284] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b65ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b65ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x176d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 0 [0030.284] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.284] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg")) returned 1 [0030.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg")) returned 0xffffffff [0030.285] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d18e120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6d18e120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6d1b4280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6218, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBO3tl[1].jpg", cAlternateFileName="BBBO3T~1.JPG")) returned 1 [0030.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg")) returned 0x2020 [0030.285] VirtualAlloc (lpAddress=0x25c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x25c000 [0030.286] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.286] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.286] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.289] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.290] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.290] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.290] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.290] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.290] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.291] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.291] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.291] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.291] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.291] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.291] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x218, lpOverlapped=0x0) returned 1 [0030.291] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x218, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x218, lpOverlapped=0x0) returned 1 [0030.292] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.292] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.292] CloseHandle (hObject=0xf8) returned 1 [0030.292] CloseHandle (hObject=0x114) returned 1 [0030.293] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.crypt")) returned 0 [0030.293] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.crypt")) returned 0x2020 [0030.293] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d18e120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6d18e120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6d1b4280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6218, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO3tl[1].jpg", cAlternateFileName="BBBO3T~1.JPG")) returned 0x5c9000 [0030.293] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d18e120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6d18e120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6d1b4280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6218, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO3tl[1].jpg", cAlternateFileName="BBBO3T~1.JPG")) returned 0 [0030.293] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.293] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg")) returned 1 [0030.294] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg")) returned 0xffffffff [0030.294] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBO8dQ[1].jpg", cAlternateFileName="BBBO8D~1.JPG")) returned 1 [0030.294] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg")) returned 0x2020 [0030.295] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.295] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.295] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x75a, lpOverlapped=0x0) returned 1 [0030.297] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x75a, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x75a, lpOverlapped=0x0) returned 1 [0030.298] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.298] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.298] CloseHandle (hObject=0x114) returned 1 [0030.298] CloseHandle (hObject=0xf8) returned 1 [0030.298] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.crypt")) returned 0 [0030.299] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.crypt")) returned 0x2020 [0030.299] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO8dQ[1].jpg", cAlternateFileName="BBBO8D~1.JPG")) returned 0x5c9000 [0030.299] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO8dQ[1].jpg", cAlternateFileName="BBBO8D~1.JPG")) returned 0 [0030.299] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.299] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg")) returned 1 [0030.300] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg")) returned 0xffffffff [0030.300] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBOe7C[1].jpg", cAlternateFileName="BBBOE7~1.JPG")) returned 1 [0030.300] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg")) returned 0x2020 [0030.300] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.300] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.301] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.303] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.303] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.304] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.304] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xd89, lpOverlapped=0x0) returned 1 [0030.304] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xd89, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xd89, lpOverlapped=0x0) returned 1 [0030.304] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.304] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.304] CloseHandle (hObject=0xf8) returned 1 [0030.304] CloseHandle (hObject=0x114) returned 1 [0030.305] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.crypt")) returned 0 [0030.305] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.crypt")) returned 0x2020 [0030.305] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOe7C[1].jpg", cAlternateFileName="BBBOE7~1.JPG")) returned 0x5c9000 [0030.306] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOe7C[1].jpg", cAlternateFileName="BBBOE7~1.JPG")) returned 0 [0030.306] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.306] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg")) returned 1 [0030.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg")) returned 0xffffffff [0030.307] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e36, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBPThN[1].jpg", cAlternateFileName="BBBPTH~1.JPG")) returned 1 [0030.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg")) returned 0x2020 [0030.307] VirtualAlloc (lpAddress=0x260000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x260000 [0030.308] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.308] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.309] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.311] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.311] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xe36, lpOverlapped=0x0) returned 1 [0030.312] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xe36, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xe36, lpOverlapped=0x0) returned 1 [0030.312] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.312] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.312] CloseHandle (hObject=0x114) returned 1 [0030.312] CloseHandle (hObject=0xf8) returned 1 [0030.313] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.crypt")) returned 0 [0030.313] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.crypt")) returned 0x2020 [0030.313] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e36, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPThN[1].jpg", cAlternateFileName="BBBPTH~1.JPG")) returned 0x5c9000 [0030.313] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e36, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPThN[1].jpg", cAlternateFileName="BBBPTH~1.JPG")) returned 0 [0030.313] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.314] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg")) returned 1 [0030.314] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg")) returned 0xffffffff [0030.314] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBPUFJ[1].jpg", cAlternateFileName="BBBPUF~1.JPG")) returned 1 [0030.315] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg")) returned 0x2020 [0030.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.317] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.319] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.320] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xee7, lpOverlapped=0x0) returned 1 [0030.320] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xee7, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xee7, lpOverlapped=0x0) returned 1 [0030.321] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.321] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.321] CloseHandle (hObject=0xf8) returned 1 [0030.321] CloseHandle (hObject=0x114) returned 1 [0030.321] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.crypt")) returned 0 [0030.322] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.crypt")) returned 0x2020 [0030.322] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPUFJ[1].jpg", cAlternateFileName="BBBPUF~1.JPG")) returned 0x5c9000 [0030.322] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPUFJ[1].jpg", cAlternateFileName="BBBPUF~1.JPG")) returned 0 [0030.322] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.322] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg")) returned 1 [0030.323] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg")) returned 0xffffffff [0030.323] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBQxzx[1].jpg", cAlternateFileName="BBBQXZ~1.JPG")) returned 1 [0030.323] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg")) returned 0x2020 [0030.324] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.324] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.324] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x924, lpOverlapped=0x0) returned 1 [0030.326] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x924, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x924, lpOverlapped=0x0) returned 1 [0030.327] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.327] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.327] CloseHandle (hObject=0x114) returned 1 [0030.327] CloseHandle (hObject=0xf8) returned 1 [0030.327] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.crypt")) returned 0 [0030.328] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.crypt")) returned 0x2020 [0030.328] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBQxzx[1].jpg", cAlternateFileName="BBBQXZ~1.JPG")) returned 0x5c9000 [0030.328] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBQxzx[1].jpg", cAlternateFileName="BBBQXZ~1.JPG")) returned 0 [0030.328] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.328] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg")) returned 1 [0030.329] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg")) returned 0xffffffff [0030.329] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBseMP[1].jpg", cAlternateFileName="BBBSEM~1.JPG")) returned 1 [0030.331] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg")) returned 0x2020 [0030.331] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.331] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.332] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.334] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.334] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x963, lpOverlapped=0x0) returned 1 [0030.335] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x963, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x963, lpOverlapped=0x0) returned 1 [0030.335] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.335] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.335] CloseHandle (hObject=0xf8) returned 1 [0030.335] CloseHandle (hObject=0x114) returned 1 [0030.336] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.crypt")) returned 0 [0030.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.crypt")) returned 0x2020 [0030.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBseMP[1].jpg", cAlternateFileName="BBBSEM~1.JPG")) returned 0x5c9000 [0030.336] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBseMP[1].jpg", cAlternateFileName="BBBSEM~1.JPG")) returned 0 [0030.336] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.337] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg")) returned 1 [0030.337] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg")) returned 0xffffffff [0030.337] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53af3bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53af3bd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53af3bd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16d6, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBsqNL[1].jpg", cAlternateFileName="BBBSQN~1.JPG")) returned 1 [0030.338] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg")) returned 0x2020 [0030.338] VirtualAlloc (lpAddress=0x264000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x264000 [0030.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.338] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.340] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.341] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x6d6, lpOverlapped=0x0) returned 1 [0030.341] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x6d6, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x6d6, lpOverlapped=0x0) returned 1 [0030.342] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.342] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.342] CloseHandle (hObject=0x114) returned 1 [0030.342] CloseHandle (hObject=0xf8) returned 1 [0030.343] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.crypt")) returned 0 [0030.343] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.crypt")) returned 0x2020 [0030.343] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53af3bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53af3bd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53af3bd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16d6, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBsqNL[1].jpg", cAlternateFileName="BBBSQN~1.JPG")) returned 0x5c9000 [0030.343] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53af3bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53af3bd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53af3bd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16d6, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBsqNL[1].jpg", cAlternateFileName="BBBSQN~1.JPG")) returned 0 [0030.343] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.343] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg")) returned 1 [0030.344] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg")) returned 0xffffffff [0030.344] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7ae, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBTpvW[1].jpg", cAlternateFileName="BBBTPV~1.JPG")) returned 1 [0030.344] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg")) returned 0x2020 [0030.345] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.345] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.345] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7ae, lpOverlapped=0x0) returned 1 [0030.347] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7ae, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7ae, lpOverlapped=0x0) returned 1 [0030.347] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.347] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.348] CloseHandle (hObject=0xf8) returned 1 [0030.348] CloseHandle (hObject=0x114) returned 1 [0030.348] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.crypt")) returned 0 [0030.349] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.crypt")) returned 0x2020 [0030.349] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7ae, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBTpvW[1].jpg", cAlternateFileName="BBBTPV~1.JPG")) returned 0x5c9000 [0030.349] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7ae, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBTpvW[1].jpg", cAlternateFileName="BBBTPV~1.JPG")) returned 0 [0030.349] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.349] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg")) returned 1 [0030.350] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg")) returned 0xffffffff [0030.350] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 1 [0030.350] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg")) returned 0x2020 [0030.350] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.350] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.350] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x974, lpOverlapped=0x0) returned 1 [0030.352] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x974, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x974, lpOverlapped=0x0) returned 1 [0030.353] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.353] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.353] CloseHandle (hObject=0x114) returned 1 [0030.353] CloseHandle (hObject=0xf8) returned 1 [0030.354] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.crypt")) returned 0 [0030.354] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.crypt")) returned 0x2020 [0030.354] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 0x5c9000 [0030.355] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 0 [0030.355] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.355] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg")) returned 1 [0030.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg")) returned 0xffffffff [0030.356] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e67, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBVGsM[1].jpg", cAlternateFileName="BBBVGS~1.JPG")) returned 1 [0030.356] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg")) returned 0x2020 [0030.356] VirtualAlloc (lpAddress=0x268000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x268000 [0030.356] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.356] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.356] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.358] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.359] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xe67, lpOverlapped=0x0) returned 1 [0030.359] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xe67, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xe67, lpOverlapped=0x0) returned 1 [0030.360] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.360] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.360] CloseHandle (hObject=0xf8) returned 1 [0030.360] CloseHandle (hObject=0x114) returned 1 [0030.360] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.crypt")) returned 0 [0030.361] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.crypt")) returned 0x2020 [0030.361] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e67, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVGsM[1].jpg", cAlternateFileName="BBBVGS~1.JPG")) returned 0x5c9000 [0030.361] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e67, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVGsM[1].jpg", cAlternateFileName="BBBVGS~1.JPG")) returned 0 [0030.361] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.361] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg")) returned 1 [0030.362] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg")) returned 0xffffffff [0030.362] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa8, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBVIzI[1].jpg", cAlternateFileName="BBBVIZ~1.JPG")) returned 1 [0030.362] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg")) returned 0x2020 [0030.363] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.363] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.363] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xaa8, lpOverlapped=0x0) returned 1 [0030.365] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xaa8, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xaa8, lpOverlapped=0x0) returned 1 [0030.366] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.366] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.366] CloseHandle (hObject=0x114) returned 1 [0030.366] CloseHandle (hObject=0xf8) returned 1 [0030.367] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.crypt")) returned 0 [0030.367] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.crypt")) returned 0x2020 [0030.367] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVIzI[1].jpg", cAlternateFileName="BBBVIZ~1.JPG")) returned 0x5c9000 [0030.367] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVIzI[1].jpg", cAlternateFileName="BBBVIZ~1.JPG")) returned 0 [0030.367] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.367] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg")) returned 1 [0030.368] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg")) returned 0xffffffff [0030.368] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97a, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBVJ4r[1].jpg", cAlternateFileName="BBBVJ4~1.JPG")) returned 1 [0030.368] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg")) returned 0x2020 [0030.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.369] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x97a, lpOverlapped=0x0) returned 1 [0030.371] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x97a, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x97a, lpOverlapped=0x0) returned 1 [0030.372] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.372] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.372] CloseHandle (hObject=0xf8) returned 1 [0030.372] CloseHandle (hObject=0x114) returned 1 [0030.373] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.crypt")) returned 0 [0030.373] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.crypt")) returned 0x2020 [0030.373] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVJ4r[1].jpg", cAlternateFileName="BBBVJ4~1.JPG")) returned 0x5c9000 [0030.373] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVJ4r[1].jpg", cAlternateFileName="BBBVJ4~1.JPG")) returned 0 [0030.373] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.373] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg")) returned 1 [0030.374] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg")) returned 0xffffffff [0030.374] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5160e6d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5160e6d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5160e6d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBVxM8[1].jpg", cAlternateFileName="BBBVXM~1.JPG")) returned 1 [0030.374] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg")) returned 0x2020 [0030.374] VirtualAlloc (lpAddress=0x26c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x26c000 [0030.375] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.375] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.375] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7d8, lpOverlapped=0x0) returned 1 [0030.376] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7d8, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7d8, lpOverlapped=0x0) returned 1 [0030.377] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.377] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.377] CloseHandle (hObject=0x114) returned 1 [0030.378] CloseHandle (hObject=0xf8) returned 1 [0030.378] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.crypt")) returned 0 [0030.378] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.crypt")) returned 0x2020 [0030.379] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5160e6d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5160e6d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5160e6d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVxM8[1].jpg", cAlternateFileName="BBBVXM~1.JPG")) returned 0x5c9000 [0030.379] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5160e6d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5160e6d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5160e6d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVxM8[1].jpg", cAlternateFileName="BBBVXM~1.JPG")) returned 0 [0030.379] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.379] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg")) returned 1 [0030.380] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg")) returned 0xffffffff [0030.380] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538de890, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538de890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538de890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBz9wz[1].jpg", cAlternateFileName="BBBZ9W~1.JPG")) returned 1 [0030.380] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg")) returned 0x2020 [0030.382] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.382] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.382] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x8d7, lpOverlapped=0x0) returned 1 [0030.383] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x8d7, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x8d7, lpOverlapped=0x0) returned 1 [0030.384] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.384] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.384] CloseHandle (hObject=0xf8) returned 1 [0030.385] CloseHandle (hObject=0x114) returned 1 [0030.385] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.crypt")) returned 0 [0030.385] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.crypt")) returned 0x2020 [0030.386] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538de890, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538de890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538de890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBz9wz[1].jpg", cAlternateFileName="BBBZ9W~1.JPG")) returned 0x5c9000 [0030.386] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538de890, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538de890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538de890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBz9wz[1].jpg", cAlternateFileName="BBBZ9W~1.JPG")) returned 0 [0030.386] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.386] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg")) returned 1 [0030.387] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg")) returned 0xffffffff [0030.387] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24be, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBzxW1[1].jpg", cAlternateFileName="BBBZXW~1.JPG")) returned 1 [0030.387] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg")) returned 0x2020 [0030.387] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.387] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.388] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.390] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.390] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.391] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.391] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x4be, lpOverlapped=0x0) returned 1 [0030.391] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x4be, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x4be, lpOverlapped=0x0) returned 1 [0030.391] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.391] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.391] CloseHandle (hObject=0x114) returned 1 [0030.391] CloseHandle (hObject=0xf8) returned 1 [0030.392] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.crypt")) returned 0 [0030.392] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.crypt")) returned 0x2020 [0030.392] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24be, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBzxW1[1].jpg", cAlternateFileName="BBBZXW~1.JPG")) returned 0x5c9000 [0030.393] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6421e580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6421e580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24be, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBzxW1[1].jpg", cAlternateFileName="BBBZXW~1.JPG")) returned 0 [0030.393] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.393] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg")) returned 1 [0030.394] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg")) returned 0xffffffff [0030.394] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6125cc20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6125cc20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 1 [0030.394] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg")) returned 0x2020 [0030.395] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.395] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.395] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.397] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.398] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.398] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.398] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.398] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.399] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x3a8, lpOverlapped=0x0) returned 1 [0030.399] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x3a8, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x3a8, lpOverlapped=0x0) returned 1 [0030.399] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.399] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.399] CloseHandle (hObject=0xf8) returned 1 [0030.399] CloseHandle (hObject=0x114) returned 1 [0030.400] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.crypt")) returned 0 [0030.400] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.crypt")) returned 0x2020 [0030.400] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6125cc20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6125cc20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 0x5c9000 [0030.400] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6125cc20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6125cc20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 0 [0030.400] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.400] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg")) returned 1 [0030.401] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg")) returned 0xffffffff [0030.401] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC095c[1].jpg", cAlternateFileName="BBC095~1.JPG")) returned 1 [0030.401] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg")) returned 0x2020 [0030.402] VirtualAlloc (lpAddress=0x270000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x270000 [0030.402] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.403] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.403] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x738, lpOverlapped=0x0) returned 1 [0030.404] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x738, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x738, lpOverlapped=0x0) returned 1 [0030.405] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.405] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.405] CloseHandle (hObject=0x114) returned 1 [0030.405] CloseHandle (hObject=0xf8) returned 1 [0030.406] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg.crypt")) returned 0 [0030.406] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg.crypt")) returned 0x2020 [0030.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC095c[1].jpg", cAlternateFileName="BBC095~1.JPG")) returned 0x5c9000 [0030.407] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC095c[1].jpg", cAlternateFileName="BBC095~1.JPG")) returned 0 [0030.407] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.407] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg")) returned 1 [0030.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg")) returned 0xffffffff [0030.408] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17a5, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 1 [0030.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg")) returned 0x2020 [0030.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.411] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.413] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.414] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7a5, lpOverlapped=0x0) returned 1 [0030.414] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7a5, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7a5, lpOverlapped=0x0) returned 1 [0030.414] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.414] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.414] CloseHandle (hObject=0xf8) returned 1 [0030.415] CloseHandle (hObject=0x114) returned 1 [0030.416] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg.crypt")) returned 0 [0030.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg.crypt")) returned 0x2020 [0030.416] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17a5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 0x5c9000 [0030.416] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17a5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 0 [0030.416] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.416] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg")) returned 1 [0030.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg")) returned 0xffffffff [0030.417] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2720, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0lYn[1].jpg", cAlternateFileName="BBC0LY~1.JPG")) returned 1 [0030.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg")) returned 0x2020 [0030.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.419] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.420] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.421] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.422] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.422] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x720, lpOverlapped=0x0) returned 1 [0030.422] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x720, lpOverlapped=0x0) returned 1 [0030.422] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.422] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.422] CloseHandle (hObject=0x114) returned 1 [0030.422] CloseHandle (hObject=0xf8) returned 1 [0030.423] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg.crypt")) returned 0 [0030.423] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg.crypt")) returned 0x2020 [0030.423] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2720, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0lYn[1].jpg", cAlternateFileName="BBC0LY~1.JPG")) returned 0x5c9000 [0030.423] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2720, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0lYn[1].jpg", cAlternateFileName="BBC0LY~1.JPG")) returned 0 [0030.423] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.423] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg")) returned 1 [0030.424] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg")) returned 0xffffffff [0030.424] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x522, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0mlu[1].jpg", cAlternateFileName="BBC0ML~1.JPG")) returned 1 [0030.424] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg")) returned 0x2020 [0030.425] VirtualAlloc (lpAddress=0x274000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x274000 [0030.425] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.425] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.425] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x522, lpOverlapped=0x0) returned 1 [0030.427] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x522, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x522, lpOverlapped=0x0) returned 1 [0030.427] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.428] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.428] CloseHandle (hObject=0xf8) returned 1 [0030.428] CloseHandle (hObject=0x114) returned 1 [0030.428] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg.crypt")) returned 0 [0030.429] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg.crypt")) returned 0x2020 [0030.429] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x522, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0mlu[1].jpg", cAlternateFileName="BBC0ML~1.JPG")) returned 0x5c9000 [0030.429] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x522, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0mlu[1].jpg", cAlternateFileName="BBC0ML~1.JPG")) returned 0 [0030.429] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.429] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg")) returned 1 [0030.430] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg")) returned 0xffffffff [0030.430] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x188f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0rDa[1].jpg", cAlternateFileName="BBC0RD~1.JPG")) returned 1 [0030.430] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg")) returned 0x2020 [0030.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.431] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.433] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.433] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x88f, lpOverlapped=0x0) returned 1 [0030.434] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x88f, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x88f, lpOverlapped=0x0) returned 1 [0030.434] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.434] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.434] CloseHandle (hObject=0x114) returned 1 [0030.434] CloseHandle (hObject=0xf8) returned 1 [0030.435] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg.crypt")) returned 0 [0030.435] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg.crypt")) returned 0x2020 [0030.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x188f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0rDa[1].jpg", cAlternateFileName="BBC0RD~1.JPG")) returned 0x5c9000 [0030.435] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x188f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0rDa[1].jpg", cAlternateFileName="BBC0RD~1.JPG")) returned 0 [0030.435] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.435] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg")) returned 1 [0030.436] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg")) returned 0xffffffff [0030.436] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fe, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0rDa[2].jpg", cAlternateFileName="BBC0RD~2.JPG")) returned 1 [0030.436] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg")) returned 0x2020 [0030.436] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.437] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7fe, lpOverlapped=0x0) returned 1 [0030.438] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7fe, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7fe, lpOverlapped=0x0) returned 1 [0030.439] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.439] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.439] CloseHandle (hObject=0xf8) returned 1 [0030.439] CloseHandle (hObject=0x114) returned 1 [0030.440] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg.crypt")) returned 0 [0030.440] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg.crypt")) returned 0x2020 [0030.441] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fe, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0rDa[2].jpg", cAlternateFileName="BBC0RD~2.JPG")) returned 0x5c9000 [0030.441] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fe, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0rDa[2].jpg", cAlternateFileName="BBC0RD~2.JPG")) returned 0 [0030.441] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.441] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg")) returned 1 [0030.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg")) returned 0xffffffff [0030.442] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x320d, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 1 [0030.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg")) returned 0x2020 [0030.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.443] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.447] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.448] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.449] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.449] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.449] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.449] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x20d, lpOverlapped=0x0) returned 1 [0030.449] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x20d, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x20d, lpOverlapped=0x0) returned 1 [0030.449] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.449] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.449] CloseHandle (hObject=0x114) returned 1 [0030.449] CloseHandle (hObject=0xf8) returned 1 [0030.450] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg.crypt")) returned 0 [0030.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg.crypt")) returned 0x2020 [0030.451] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x320d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 0x5c9000 [0030.451] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x320d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 0 [0030.451] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.451] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg")) returned 1 [0030.452] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg")) returned 0xffffffff [0030.452] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28f2, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBDK7Yy[1].jpg", cAlternateFileName="BBDK7Y~1.JPG")) returned 1 [0030.452] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg")) returned 0x2020 [0030.452] VirtualAlloc (lpAddress=0x278000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x278000 [0030.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.453] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.453] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.455] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.456] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.456] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.456] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x8f2, lpOverlapped=0x0) returned 1 [0030.457] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x8f2, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x8f2, lpOverlapped=0x0) returned 1 [0030.457] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.457] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.457] CloseHandle (hObject=0xf8) returned 1 [0030.457] CloseHandle (hObject=0x114) returned 1 [0030.458] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg.crypt")) returned 0 [0030.458] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg.crypt")) returned 0x2020 [0030.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28f2, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDK7Yy[1].jpg", cAlternateFileName="BBDK7Y~1.JPG")) returned 0x5c9000 [0030.458] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x28f2, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDK7Yy[1].jpg", cAlternateFileName="BBDK7Y~1.JPG")) returned 0 [0030.458] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.458] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg")) returned 1 [0030.459] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg")) returned 0xffffffff [0030.459] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBDRbsH[1].jpg", cAlternateFileName="BBDRBS~1.JPG")) returned 1 [0030.459] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg")) returned 0x2020 [0030.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.460] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x83c, lpOverlapped=0x0) returned 1 [0030.462] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x83c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x83c, lpOverlapped=0x0) returned 1 [0030.463] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.463] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.463] CloseHandle (hObject=0x114) returned 1 [0030.463] CloseHandle (hObject=0xf8) returned 1 [0030.463] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg.crypt")) returned 0 [0030.464] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg.crypt")) returned 0x2020 [0030.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDRbsH[1].jpg", cAlternateFileName="BBDRBS~1.JPG")) returned 0x5c9000 [0030.464] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDRbsH[1].jpg", cAlternateFileName="BBDRBS~1.JPG")) returned 0 [0030.464] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.464] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg")) returned 1 [0030.465] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg")) returned 0xffffffff [0030.465] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBDZoZR[1].jpg", cAlternateFileName="BBDZOZ~1.JPG")) returned 1 [0030.465] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg")) returned 0x2020 [0030.465] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.465] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.466] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x968, lpOverlapped=0x0) returned 1 [0030.467] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x968, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x968, lpOverlapped=0x0) returned 1 [0030.468] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.468] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.468] CloseHandle (hObject=0xf8) returned 1 [0030.468] CloseHandle (hObject=0x114) returned 1 [0030.469] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg.crypt")) returned 0 [0030.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg.crypt")) returned 0x2020 [0030.469] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDZoZR[1].jpg", cAlternateFileName="BBDZOZ~1.JPG")) returned 0x5c9000 [0030.469] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDZoZR[1].jpg", cAlternateFileName="BBDZOZ~1.JPG")) returned 0 [0030.469] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.470] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg")) returned 1 [0030.470] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg")) returned 0xffffffff [0030.470] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBE97O8[1].jpg", cAlternateFileName="BBE97O~1.JPG")) returned 1 [0030.470] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg")) returned 0x2020 [0030.471] VirtualAlloc (lpAddress=0x27c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27c000 [0030.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.472] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x8d4, lpOverlapped=0x0) returned 1 [0030.473] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x8d4, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x8d4, lpOverlapped=0x0) returned 1 [0030.474] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.474] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.474] CloseHandle (hObject=0x114) returned 1 [0030.474] CloseHandle (hObject=0xf8) returned 1 [0030.475] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg.crypt")) returned 0 [0030.476] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg.crypt")) returned 0x2020 [0030.476] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE97O8[1].jpg", cAlternateFileName="BBE97O~1.JPG")) returned 0x5c9000 [0030.476] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE97O8[1].jpg", cAlternateFileName="BBE97O~1.JPG")) returned 0 [0030.476] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.476] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg")) returned 1 [0030.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg")) returned 0xffffffff [0030.477] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6e0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBE9wSt[1].jpg", cAlternateFileName="BBE9WS~1.JPG")) returned 1 [0030.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg")) returned 0x2020 [0030.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.478] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x6e0, lpOverlapped=0x0) returned 1 [0030.480] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x6e0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x6e0, lpOverlapped=0x0) returned 1 [0030.481] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.481] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.481] CloseHandle (hObject=0xf8) returned 1 [0030.481] CloseHandle (hObject=0x114) returned 1 [0030.482] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg.crypt")) returned 0 [0030.482] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg.crypt")) returned 0x2020 [0030.482] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6e0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE9wSt[1].jpg", cAlternateFileName="BBE9WS~1.JPG")) returned 0x5c9000 [0030.483] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6e0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE9wSt[1].jpg", cAlternateFileName="BBE9WS~1.JPG")) returned 0 [0030.483] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.483] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg")) returned 1 [0030.484] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg")) returned 0xffffffff [0030.484] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEcHle[1].jpg", cAlternateFileName="BBECHL~1.JPG")) returned 1 [0030.484] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg")) returned 0x2020 [0030.485] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.485] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.487] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x8b9, lpOverlapped=0x0) returned 1 [0030.489] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x8b9, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x8b9, lpOverlapped=0x0) returned 1 [0030.490] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.490] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.490] CloseHandle (hObject=0x114) returned 1 [0030.490] CloseHandle (hObject=0xf8) returned 1 [0030.491] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg.crypt")) returned 0 [0030.492] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg.crypt")) returned 0x2020 [0030.492] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEcHle[1].jpg", cAlternateFileName="BBECHL~1.JPG")) returned 0x5c9000 [0030.492] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEcHle[1].jpg", cAlternateFileName="BBECHL~1.JPG")) returned 0 [0030.492] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.492] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg")) returned 1 [0030.493] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg")) returned 0xffffffff [0030.493] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEdE0f[1].jpg", cAlternateFileName="BBEDE0~1.JPG")) returned 1 [0030.493] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg")) returned 0x2020 [0030.494] VirtualAlloc (lpAddress=0x280000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x280000 [0030.494] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.494] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.495] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.496] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.497] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.498] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.498] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x86, lpOverlapped=0x0) returned 1 [0030.498] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x86, lpOverlapped=0x0) returned 1 [0030.498] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.498] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.498] CloseHandle (hObject=0xf8) returned 1 [0030.498] CloseHandle (hObject=0x114) returned 1 [0030.499] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg.crypt")) returned 0 [0030.499] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg.crypt")) returned 0x2020 [0030.499] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdE0f[1].jpg", cAlternateFileName="BBEDE0~1.JPG")) returned 0x5c9000 [0030.499] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdE0f[1].jpg", cAlternateFileName="BBEDE0~1.JPG")) returned 0 [0030.499] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.500] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg")) returned 1 [0030.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg")) returned 0xffffffff [0030.501] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEdoQv[1].jpg", cAlternateFileName="BBEDOQ~1.JPG")) returned 1 [0030.501] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg")) returned 0x2020 [0030.501] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.502] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.502] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x97b, lpOverlapped=0x0) returned 1 [0030.503] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x97b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x97b, lpOverlapped=0x0) returned 1 [0030.504] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.504] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.504] CloseHandle (hObject=0x114) returned 1 [0030.504] CloseHandle (hObject=0xf8) returned 1 [0030.505] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg.crypt")) returned 0 [0030.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg.crypt")) returned 0x2020 [0030.505] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdoQv[1].jpg", cAlternateFileName="BBEDOQ~1.JPG")) returned 0x5c9000 [0030.505] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdoQv[1].jpg", cAlternateFileName="BBEDOQ~1.JPG")) returned 0 [0030.505] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.506] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg")) returned 1 [0030.506] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg")) returned 0xffffffff [0030.507] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEdqEy[1].jpg", cAlternateFileName="BBEDQE~1.JPG")) returned 1 [0030.507] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg")) returned 0x2020 [0030.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.508] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x69a, lpOverlapped=0x0) returned 1 [0030.512] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x69a, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x69a, lpOverlapped=0x0) returned 1 [0030.513] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.513] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.513] CloseHandle (hObject=0xf8) returned 1 [0030.513] CloseHandle (hObject=0x114) returned 1 [0030.514] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg.crypt")) returned 0 [0030.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg.crypt")) returned 0x2020 [0030.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdqEy[1].jpg", cAlternateFileName="BBEDQE~1.JPG")) returned 0x5c9000 [0030.514] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdqEy[1].jpg", cAlternateFileName="BBEDQE~1.JPG")) returned 0 [0030.514] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.514] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg")) returned 1 [0030.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg")) returned 0xffffffff [0030.515] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6d0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEdtWw[1].jpg", cAlternateFileName="BBEDTW~1.JPG")) returned 1 [0030.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg")) returned 0x2020 [0030.516] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.516] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.516] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x6d0, lpOverlapped=0x0) returned 1 [0030.518] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x6d0, lpOverlapped=0x0) returned 1 [0030.519] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.519] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.519] CloseHandle (hObject=0x114) returned 1 [0030.519] CloseHandle (hObject=0xf8) returned 1 [0030.520] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg.crypt")) returned 0 [0030.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg.crypt")) returned 0x2020 [0030.520] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6d0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdtWw[1].jpg", cAlternateFileName="BBEDTW~1.JPG")) returned 0x5c9000 [0030.520] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6d0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdtWw[1].jpg", cAlternateFileName="BBEDTW~1.JPG")) returned 0 [0030.520] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.520] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg")) returned 1 [0030.521] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg")) returned 0xffffffff [0030.521] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEdXJj[1].jpg", cAlternateFileName="BBEDXJ~1.JPG")) returned 1 [0030.521] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg")) returned 0x2020 [0030.522] VirtualAlloc (lpAddress=0x284000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x284000 [0030.522] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.522] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.523] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x687, lpOverlapped=0x0) returned 1 [0030.524] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x687, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x687, lpOverlapped=0x0) returned 1 [0030.525] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.525] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.525] CloseHandle (hObject=0xf8) returned 1 [0030.525] CloseHandle (hObject=0x114) returned 1 [0030.526] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg.crypt")) returned 0 [0030.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg.crypt")) returned 0x2020 [0030.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdXJj[1].jpg", cAlternateFileName="BBEDXJ~1.JPG")) returned 0x5c9000 [0030.526] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdXJj[1].jpg", cAlternateFileName="BBEDXJ~1.JPG")) returned 0 [0030.526] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.526] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg")) returned 1 [0030.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg")) returned 0xffffffff [0030.527] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeP0k[1].jpg", cAlternateFileName="BBEEP0~1.JPG")) returned 1 [0030.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg")) returned 0x2020 [0030.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.528] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.534] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.535] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.535] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.535] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x4c8, lpOverlapped=0x0) returned 1 [0030.535] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x4c8, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x4c8, lpOverlapped=0x0) returned 1 [0030.535] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.535] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.536] CloseHandle (hObject=0x114) returned 1 [0030.536] CloseHandle (hObject=0xf8) returned 1 [0030.536] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg.crypt")) returned 0 [0030.537] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg.crypt")) returned 0x2020 [0030.537] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeP0k[1].jpg", cAlternateFileName="BBEEP0~1.JPG")) returned 0x5c9000 [0030.537] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeP0k[1].jpg", cAlternateFileName="BBEEP0~1.JPG")) returned 0 [0030.537] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.537] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg")) returned 1 [0030.538] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg")) returned 0xffffffff [0030.538] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3417, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 1 [0030.538] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg")) returned 0x2020 [0030.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.547] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.549] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.550] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.550] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.550] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.550] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.551] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x417, lpOverlapped=0x0) returned 1 [0030.551] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x417, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x417, lpOverlapped=0x0) returned 1 [0030.551] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.551] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.551] CloseHandle (hObject=0xf8) returned 1 [0030.551] CloseHandle (hObject=0x114) returned 1 [0030.552] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg.crypt")) returned 0 [0030.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg.crypt")) returned 0x2020 [0030.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3417, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 0x5c9000 [0030.552] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3417, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 0 [0030.552] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.552] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg")) returned 1 [0030.554] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg")) returned 0xffffffff [0030.554] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xc0b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfE6e[1].jpg", cAlternateFileName="BBEFE6~1.JPG")) returned 1 [0030.554] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg")) returned 0x2020 [0030.554] VirtualAlloc (lpAddress=0x288000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x288000 [0030.555] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.555] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.555] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xc0b, lpOverlapped=0x0) returned 1 [0030.556] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xc0b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xc0b, lpOverlapped=0x0) returned 1 [0030.557] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.557] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.557] CloseHandle (hObject=0x114) returned 1 [0030.558] CloseHandle (hObject=0xf8) returned 1 [0030.558] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg.crypt")) returned 0 [0030.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg.crypt")) returned 0x2020 [0030.559] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xc0b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfE6e[1].jpg", cAlternateFileName="BBEFE6~1.JPG")) returned 0x5c9000 [0030.559] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xc0b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfE6e[1].jpg", cAlternateFileName="BBEFE6~1.JPG")) returned 0 [0030.559] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.559] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg")) returned 1 [0030.560] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg")) returned 0xffffffff [0030.560] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c4c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 1 [0030.561] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg")) returned 0x2020 [0030.562] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.562] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.562] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.564] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.565] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.565] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.565] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.565] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.566] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xc4c, lpOverlapped=0x0) returned 1 [0030.566] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xc4c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xc4c, lpOverlapped=0x0) returned 1 [0030.566] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.566] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.566] CloseHandle (hObject=0xf8) returned 1 [0030.566] CloseHandle (hObject=0x114) returned 1 [0030.567] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg.crypt")) returned 0 [0030.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg.crypt")) returned 0x2020 [0030.567] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c4c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 0x5c9000 [0030.567] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c4c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 0 [0030.567] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.567] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg")) returned 1 [0030.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg")) returned 0xffffffff [0030.568] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f0e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEg9QV[1].jpg", cAlternateFileName="BBEG9Q~1.JPG")) returned 1 [0030.569] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg")) returned 0x2020 [0030.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.570] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.572] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.573] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xf0e, lpOverlapped=0x0) returned 1 [0030.573] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xf0e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xf0e, lpOverlapped=0x0) returned 1 [0030.573] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.573] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.573] CloseHandle (hObject=0x114) returned 1 [0030.573] CloseHandle (hObject=0xf8) returned 1 [0030.574] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg.crypt")) returned 0 [0030.574] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg.crypt")) returned 0x2020 [0030.574] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f0e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEg9QV[1].jpg", cAlternateFileName="BBEG9Q~1.JPG")) returned 0x5c9000 [0030.574] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f0e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEg9QV[1].jpg", cAlternateFileName="BBEG9Q~1.JPG")) returned 0 [0030.574] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.574] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg")) returned 1 [0030.575] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg")) returned 0xffffffff [0030.575] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgGSl[1].jpg", cAlternateFileName="BBEGGS~1.JPG")) returned 1 [0030.575] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg")) returned 0x2020 [0030.577] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.577] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.577] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x980, lpOverlapped=0x0) returned 1 [0030.581] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x980, lpOverlapped=0x0) returned 1 [0030.582] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.582] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.582] CloseHandle (hObject=0xf8) returned 1 [0030.582] CloseHandle (hObject=0x114) returned 1 [0030.583] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg.crypt")) returned 0 [0030.583] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg.crypt")) returned 0x2020 [0030.583] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgGSl[1].jpg", cAlternateFileName="BBEGGS~1.JPG")) returned 0x5c9000 [0030.583] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgGSl[1].jpg", cAlternateFileName="BBEGGS~1.JPG")) returned 0 [0030.584] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.584] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg")) returned 1 [0030.585] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg")) returned 0xffffffff [0030.585] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgiYw[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 1 [0030.585] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg")) returned 0x2020 [0030.590] VirtualAlloc (lpAddress=0x28c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x28c000 [0030.591] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.591] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.591] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.593] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.594] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.594] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.594] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x3fd, lpOverlapped=0x0) returned 1 [0030.594] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x3fd, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x3fd, lpOverlapped=0x0) returned 1 [0030.594] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.594] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.594] CloseHandle (hObject=0x114) returned 1 [0030.594] CloseHandle (hObject=0xf8) returned 1 [0030.595] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg.crypt")) returned 0 [0030.595] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg.crypt")) returned 0x2020 [0030.596] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgiYw[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 0x5c9000 [0030.596] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgiYw[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 0 [0030.596] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.596] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg")) returned 1 [0030.597] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg")) returned 0xffffffff [0030.597] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a59, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 1 [0030.597] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg")) returned 0x2020 [0030.598] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.598] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.598] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.600] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.601] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xa59, lpOverlapped=0x0) returned 1 [0030.601] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xa59, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xa59, lpOverlapped=0x0) returned 1 [0030.602] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.602] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.602] CloseHandle (hObject=0xf8) returned 1 [0030.602] CloseHandle (hObject=0x114) returned 1 [0030.603] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg.crypt")) returned 0 [0030.603] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg.crypt")) returned 0x2020 [0030.603] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a59, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 0x5c9000 [0030.603] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a59, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 0 [0030.603] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.603] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg")) returned 1 [0030.604] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg")) returned 0xffffffff [0030.604] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7b0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgqtY[1].jpg", cAlternateFileName="BBEGQT~1.JPG")) returned 1 [0030.604] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg")) returned 0x2020 [0030.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.605] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7b0, lpOverlapped=0x0) returned 1 [0030.607] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7b0, lpOverlapped=0x0) returned 1 [0030.608] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.608] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.608] CloseHandle (hObject=0x114) returned 1 [0030.608] CloseHandle (hObject=0xf8) returned 1 [0030.609] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg.crypt")) returned 0 [0030.609] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg.crypt")) returned 0x2020 [0030.609] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7b0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgqtY[1].jpg", cAlternateFileName="BBEGQT~1.JPG")) returned 0x5c9000 [0030.609] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7b0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgqtY[1].jpg", cAlternateFileName="BBEGQT~1.JPG")) returned 0 [0030.609] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.610] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg")) returned 1 [0030.610] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg")) returned 0xffffffff [0030.610] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x44ec, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 1 [0030.611] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg")) returned 0x2020 [0030.611] VirtualAlloc (lpAddress=0x290000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x290000 [0030.611] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.612] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.612] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.614] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.615] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.615] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.615] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.615] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.615] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.616] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.616] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x4ec, lpOverlapped=0x0) returned 1 [0030.616] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x4ec, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x4ec, lpOverlapped=0x0) returned 1 [0030.616] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.616] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.616] CloseHandle (hObject=0xf8) returned 1 [0030.616] CloseHandle (hObject=0x114) returned 1 [0030.617] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg.crypt")) returned 0 [0030.617] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg.crypt")) returned 0x2020 [0030.617] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x44ec, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 0x5c9000 [0030.617] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x44ec, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 0 [0030.618] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.618] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg")) returned 1 [0030.619] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg")) returned 0xffffffff [0030.619] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x171b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgtcS[1].jpg", cAlternateFileName="BBEGTC~1.JPG")) returned 1 [0030.619] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg")) returned 0x2020 [0030.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.620] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.622] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.623] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x71b, lpOverlapped=0x0) returned 1 [0030.623] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x71b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x71b, lpOverlapped=0x0) returned 1 [0030.623] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.623] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.623] CloseHandle (hObject=0x114) returned 1 [0030.623] CloseHandle (hObject=0xf8) returned 1 [0030.624] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg.crypt")) returned 0 [0030.624] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg.crypt")) returned 0x2020 [0030.624] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x171b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgtcS[1].jpg", cAlternateFileName="BBEGTC~1.JPG")) returned 0x5c9000 [0030.624] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x171b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgtcS[1].jpg", cAlternateFileName="BBEGTC~1.JPG")) returned 0 [0030.624] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.625] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg")) returned 1 [0030.625] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg")) returned 0xffffffff [0030.626] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgtcS[2].jpg", cAlternateFileName="BBEGTC~2.JPG")) returned 1 [0030.626] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg")) returned 0x2020 [0030.656] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.656] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.656] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.658] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.659] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x826, lpOverlapped=0x0) returned 1 [0030.659] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x826, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x826, lpOverlapped=0x0) returned 1 [0030.660] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.660] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.660] CloseHandle (hObject=0xf8) returned 1 [0030.660] CloseHandle (hObject=0x114) returned 1 [0030.661] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg.crypt")) returned 0 [0030.661] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg.crypt")) returned 0x2020 [0030.661] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgtcS[2].jpg", cAlternateFileName="BBEGTC~2.JPG")) returned 0x5c9000 [0030.661] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgtcS[2].jpg", cAlternateFileName="BBEGTC~2.JPG")) returned 0 [0030.661] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.661] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg")) returned 1 [0030.662] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg")) returned 0xffffffff [0030.662] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgx5f[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 1 [0030.662] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg")) returned 0x2020 [0030.663] VirtualAlloc (lpAddress=0x294000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x294000 [0030.664] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.664] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.664] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x5e5, lpOverlapped=0x0) returned 1 [0030.665] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x5e5, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x5e5, lpOverlapped=0x0) returned 1 [0030.666] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.666] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.666] CloseHandle (hObject=0x114) returned 1 [0030.666] CloseHandle (hObject=0xf8) returned 1 [0030.667] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg.crypt")) returned 0 [0030.667] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg.crypt")) returned 0x2020 [0030.667] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgx5f[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 0x5c9000 [0030.668] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgx5f[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 0 [0030.668] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.668] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg")) returned 1 [0030.669] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg")) returned 0xffffffff [0030.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgx5f[2].jpg", cAlternateFileName="BBEGX5~2.JPG")) returned 1 [0030.669] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg")) returned 0x2020 [0030.669] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.670] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.670] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x5e5, lpOverlapped=0x0) returned 1 [0030.671] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x5e5, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x5e5, lpOverlapped=0x0) returned 1 [0030.672] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.672] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.672] CloseHandle (hObject=0xf8) returned 1 [0030.672] CloseHandle (hObject=0x114) returned 1 [0030.672] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg.crypt")) returned 0 [0030.673] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg.crypt")) returned 0x2020 [0030.673] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgx5f[2].jpg", cAlternateFileName="BBEGX5~2.JPG")) returned 0x5c9000 [0030.673] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgx5f[2].jpg", cAlternateFileName="BBEGX5~2.JPG")) returned 0 [0030.673] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.673] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg")) returned 1 [0030.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg")) returned 0xffffffff [0030.674] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgyIm[1].jpg", cAlternateFileName="BBEGYI~1.JPG")) returned 1 [0030.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg")) returned 0x2020 [0030.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.675] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.677] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.677] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.678] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.678] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.678] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.678] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x565, lpOverlapped=0x0) returned 1 [0030.678] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x565, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x565, lpOverlapped=0x0) returned 1 [0030.678] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.678] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.679] CloseHandle (hObject=0x114) returned 1 [0030.679] CloseHandle (hObject=0xf8) returned 1 [0030.679] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg.crypt")) returned 0 [0030.680] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg.crypt")) returned 0x2020 [0030.680] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgyIm[1].jpg", cAlternateFileName="BBEGYI~1.JPG")) returned 0x5c9000 [0030.680] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgyIm[1].jpg", cAlternateFileName="BBEGYI~1.JPG")) returned 0 [0030.680] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.680] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg")) returned 1 [0030.681] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg")) returned 0xffffffff [0030.681] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBg3ODX[2].png", cAlternateFileName="BBG3OD~2.PNG")) returned 1 [0030.681] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png")) returned 0x2020 [0030.682] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.682] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.682] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xf3, lpOverlapped=0x0) returned 1 [0030.684] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xf3, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xf3, lpOverlapped=0x0) returned 1 [0030.685] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.685] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.685] CloseHandle (hObject=0xf8) returned 1 [0030.685] CloseHandle (hObject=0x114) returned 1 [0030.686] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png.crypt")) returned 0 [0030.687] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png.crypt")) returned 0x2020 [0030.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBg3ODX[2].png", cAlternateFileName="BBG3OD~2.PNG")) returned 0x5c9000 [0030.687] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBg3ODX[2].png", cAlternateFileName="BBG3OD~2.PNG")) returned 0 [0030.687] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.687] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png")) returned 1 [0030.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png")) returned 0xffffffff [0030.688] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBiyCq[1].png", cAlternateFileName="BBIYCQ~1.PNG")) returned 1 [0030.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png")) returned 0x2020 [0030.689] VirtualAlloc (lpAddress=0x298000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x298000 [0030.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.690] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x3b9, lpOverlapped=0x0) returned 1 [0030.691] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x3b9, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x3b9, lpOverlapped=0x0) returned 1 [0030.692] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.693] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.693] CloseHandle (hObject=0x114) returned 1 [0030.693] CloseHandle (hObject=0xf8) returned 1 [0030.693] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png.crypt")) returned 0 [0030.695] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png.crypt")) returned 0x2020 [0030.695] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="BBiyCq[1].png", cAlternateFileName="BBIYCQ~1.PNG")) returned 0x5c9000 [0030.696] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde8add0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="BBiyCq[1].png", cAlternateFileName="BBIYCQ~1.PNG")) returned 0 [0030.696] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.696] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png")) returned 1 [0030.697] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png")) returned 0xffffffff [0030.697] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBn4lUU[1].png", cAlternateFileName="BBN4LU~1.PNG")) returned 1 [0030.697] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png")) returned 0x2020 [0030.698] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.698] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.698] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x14d, lpOverlapped=0x0) returned 1 [0030.700] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x14d, lpOverlapped=0x0) returned 1 [0030.701] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.701] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.701] CloseHandle (hObject=0xf8) returned 1 [0030.701] CloseHandle (hObject=0x114) returned 1 [0030.702] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png.crypt")) returned 0 [0030.702] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png.crypt")) returned 0x2020 [0030.702] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBn4lUU[1].png", cAlternateFileName="BBN4LU~1.PNG")) returned 0x5c9000 [0030.702] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBn4lUU[1].png", cAlternateFileName="BBN4LU~1.PNG")) returned 0 [0030.702] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.703] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png")) returned 1 [0030.703] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png")) returned 0xffffffff [0030.703] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBnMKeN[1].png", cAlternateFileName="BBNMKE~1.PNG")) returned 1 [0030.703] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png")) returned 0x2020 [0030.704] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.704] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.704] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x24b, lpOverlapped=0x0) returned 1 [0030.707] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x24b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x24b, lpOverlapped=0x0) returned 1 [0030.708] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.708] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.708] CloseHandle (hObject=0x114) returned 1 [0030.708] CloseHandle (hObject=0xf8) returned 1 [0030.709] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png.crypt")) returned 0 [0030.709] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png.crypt")) returned 0x2020 [0030.709] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBnMKeN[1].png", cAlternateFileName="BBNMKE~1.PNG")) returned 0x5c9000 [0030.710] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBnMKeN[1].png", cAlternateFileName="BBNMKE~1.PNG")) returned 0 [0030.710] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.710] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png")) returned 1 [0030.711] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png")) returned 0xffffffff [0030.711] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x38b7, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBwGan9[1].jpg", cAlternateFileName="BBWGAN~1.JPG")) returned 1 [0030.711] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg")) returned 0x2020 [0030.711] VirtualAlloc (lpAddress=0x29c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x29c000 [0030.712] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.712] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.712] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.714] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.715] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.715] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.715] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.715] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.716] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x8b7, lpOverlapped=0x0) returned 1 [0030.716] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x8b7, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x8b7, lpOverlapped=0x0) returned 1 [0030.716] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.716] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.716] CloseHandle (hObject=0xf8) returned 1 [0030.716] CloseHandle (hObject=0x114) returned 1 [0030.717] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg.crypt")) returned 0 [0030.717] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg.crypt")) returned 0x2020 [0030.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x38b7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBwGan9[1].jpg", cAlternateFileName="BBWGAN~1.JPG")) returned 0x5c9000 [0030.717] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x38b7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBwGan9[1].jpg", cAlternateFileName="BBWGAN~1.JPG")) returned 0 [0030.717] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.717] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg")) returned 1 [0030.718] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg")) returned 0xffffffff [0030.718] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBz3ebk[1].png", cAlternateFileName="BBZ3EB~1.PNG")) returned 1 [0030.718] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png")) returned 0x2020 [0030.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.719] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x36c, lpOverlapped=0x0) returned 1 [0030.721] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x36c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x36c, lpOverlapped=0x0) returned 1 [0030.722] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.722] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.722] CloseHandle (hObject=0x114) returned 1 [0030.722] CloseHandle (hObject=0xf8) returned 1 [0030.722] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png.crypt")) returned 0 [0030.723] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png.crypt")) returned 0x2020 [0030.723] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBz3ebk[1].png", cAlternateFileName="BBZ3EB~1.PNG")) returned 0x5c9000 [0030.723] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBz3ebk[1].png", cAlternateFileName="BBZ3EB~1.PNG")) returned 0 [0030.723] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.723] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png")) returned 1 [0030.724] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png")) returned 0xffffffff [0030.724] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d4dd60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d4dd60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ed, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="benefits-5-mobile[1].png", cAlternateFileName="BENEFI~1.PNG")) returned 1 [0030.724] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png")) returned 0x2020 [0030.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.726] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.728] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.728] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.729] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.729] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9ed, lpOverlapped=0x0) returned 1 [0030.729] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9ed, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9ed, lpOverlapped=0x0) returned 1 [0030.729] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.729] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.729] CloseHandle (hObject=0xf8) returned 1 [0030.729] CloseHandle (hObject=0x114) returned 1 [0030.730] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png.crypt")) returned 0 [0030.730] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png.crypt")) returned 0x2020 [0030.730] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d4dd60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d4dd60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ed, dwReserved0=0x5d6fc8, dwReserved1=0x18e59c, cFileName="benefits-5-mobile[1].png", cAlternateFileName="BENEFI~1.PNG")) returned 0x5c9000 [0030.731] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d4dd60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d4dd60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ed, dwReserved0=0x5d6fc8, dwReserved1=0x18e59c, cFileName="benefits-5-mobile[1].png", cAlternateFileName="BENEFI~1.PNG")) returned 0 [0030.731] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.731] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png")) returned 1 [0030.732] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png")) returned 0xffffffff [0030.732] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61804060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61804060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61850320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f3f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0030.732] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ea49c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ea49c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60ef0c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c6c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="chrome-new[1].jpg", cAlternateFileName="CHROME~1.JPG")) returned 1 [0030.732] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg")) returned 0x2020 [0030.734] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.734] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.735] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.737] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.738] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.738] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.738] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.738] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.738] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.738] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.739] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.739] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.739] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.739] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.739] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.739] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.739] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.740] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.740] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.740] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.740] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.740] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.740] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.741] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.741] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.741] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.741] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.741] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.741] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.741] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.742] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.742] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.742] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.742] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.742] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xc6c, lpOverlapped=0x0) returned 1 [0030.742] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xc6c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xc6c, lpOverlapped=0x0) returned 1 [0030.742] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.742] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.742] CloseHandle (hObject=0x114) returned 1 [0030.743] CloseHandle (hObject=0xf8) returned 1 [0030.744] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg.crypt")) returned 0 [0030.744] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg.crypt")) returned 0x2020 [0030.744] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ea49c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ea49c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60ef0c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c6c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="chrome-new[1].jpg", cAlternateFileName="CHROME~1.JPG")) returned 0x5c9000 [0030.744] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ea49c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ea49c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60ef0c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c6c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="chrome-new[1].jpg", cAlternateFileName="CHROME~1.JPG")) returned 0 [0030.745] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.745] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg")) returned 1 [0030.746] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg")) returned 0xffffffff [0030.746] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60b128c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4739, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot", cAlternateFileName="CJZKEO~1.EOT")) returned 1 [0030.746] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bb22b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 1 [0030.746] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe6dfad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe6dfad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe6dfad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="ContainerTag[2].js", cAlternateFileName="CONTAI~2.JS")) returned 1 [0030.746] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ddbc1a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ddbc1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ddbc1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="css[2].txt", cAlternateFileName="CSS_2_~1.TXT")) returned 1 [0030.746] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt")) returned 0x2020 [0030.747] VirtualAlloc (lpAddress=0x2a0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2a0000 [0030.747] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.747] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.748] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xbb, lpOverlapped=0x0) returned 1 [0030.748] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xbb, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xbb, lpOverlapped=0x0) returned 1 [0030.749] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.749] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.749] CloseHandle (hObject=0xf8) returned 1 [0030.749] CloseHandle (hObject=0x114) returned 1 [0030.750] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt.crypt")) returned 0 [0030.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt.crypt")) returned 0x2020 [0030.750] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ddbc1a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ddbc1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ddbc1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="css[2].txt", cAlternateFileName="CSS_2_~1.TXT")) returned 0x5c9000 [0030.751] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ddbc1a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5ddbc1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ddbc1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="css[2].txt", cAlternateFileName="CSS_2_~1.TXT")) returned 0 [0030.751] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.751] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt")) returned 1 [0030.752] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt")) returned 0xffffffff [0030.752] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0030.752] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini")) returned 0x2006 [0030.752] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.752] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.752] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x43, lpOverlapped=0x0) returned 1 [0030.753] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x43, lpOverlapped=0x0) returned 1 [0030.754] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.754] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.754] CloseHandle (hObject=0x114) returned 1 [0030.754] CloseHandle (hObject=0xf8) returned 1 [0030.755] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini.crypt")) returned 0 [0030.755] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini.crypt")) returned 0x2020 [0030.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0030.755] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0030.755] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.755] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini")) returned 1 [0030.756] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini")) returned 0xffffffff [0030.756] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5114bad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5114bad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x511bdef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39a21, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="f8-028d9f-f30905ea[1]", cAlternateFileName="F8-028~1")) returned 1 [0030.756] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf893e70, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf893e70, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf893e70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f78, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="fallback_728x90[1].jpg", cAlternateFileName="FALLBA~1.JPG")) returned 1 [0030.756] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg")) returned 0x2020 [0030.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.758] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.760] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.760] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.761] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.761] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.761] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.761] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.761] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.761] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.762] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.762] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.762] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.762] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.762] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.762] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xf78, lpOverlapped=0x0) returned 1 [0030.762] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xf78, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xf78, lpOverlapped=0x0) returned 1 [0030.763] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.763] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.763] CloseHandle (hObject=0xf8) returned 1 [0030.763] CloseHandle (hObject=0x114) returned 1 [0030.764] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg.crypt")) returned 0 [0030.764] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg.crypt")) returned 0x2020 [0030.764] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf893e70, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf893e70, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf893e70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f78, dwReserved0=0x5d6fc8, dwReserved1=0x18e59c, cFileName="fallback_728x90[1].jpg", cAlternateFileName="FALLBA~1.JPG")) returned 0x5c9000 [0030.764] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf893e70, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf893e70, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf893e70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f78, dwReserved0=0x5d6fc8, dwReserved1=0x18e59c, cFileName="fallback_728x90[1].jpg", cAlternateFileName="FALLBA~1.JPG")) returned 0 [0030.764] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.764] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg")) returned 1 [0030.765] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg")) returned 0xffffffff [0030.765] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xca2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0030.765] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde189b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde189b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde189b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1305, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~2")) returned 1 [0030.765] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x551dcf90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ie8[1].txt", cAlternateFileName="IE8_1_~1.TXT")) returned 1 [0030.766] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt")) returned 0x2020 [0030.766] VirtualAlloc (lpAddress=0x2a4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2a4000 [0030.767] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.767] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.767] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x66, lpOverlapped=0x0) returned 1 [0030.769] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x66, lpOverlapped=0x0) returned 1 [0030.770] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.770] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.770] CloseHandle (hObject=0x114) returned 1 [0030.770] CloseHandle (hObject=0xf8) returned 1 [0030.771] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt.crypt")) returned 0 [0030.771] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt.crypt")) returned 0x2020 [0030.771] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x551dcf90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="ie8[1].txt", cAlternateFileName="IE8_1_~1.TXT")) returned 0x5c9000 [0030.771] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x551dcf90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="ie8[1].txt", cAlternateFileName="IE8_1_~1.TXT")) returned 0 [0030.771] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.771] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt")) returned 1 [0030.772] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt")) returned 0xffffffff [0030.772] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bff750, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bff750, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bff750, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0030.772] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x88e7, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0030.772] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1180, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="meversion[1]", cAlternateFileName="MEVERS~1")) returned 1 [0030.772] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfaa91b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfaa91b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfaa91b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 1 [0030.772] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56ed3860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56ed3860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x56ed3860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="Passport[1].htm", cAlternateFileName="PASSPO~1.HTM")) returned 1 [0030.772] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9f32, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="plusone[1].js", cAlternateFileName="PLUSON~1.JS")) returned 1 [0030.772] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6371bfc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6371bfc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6371bfc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="postmessageRelay[1].htm", cAlternateFileName="POSTME~1.HTM")) returned 1 [0030.773] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555ac120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555ac120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55a97d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a6f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="search[1].htm", cAlternateFileName="SEARCH~1.HTM")) returned 1 [0030.773] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c85b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="uhf-west-european-default.min[1].css", cAlternateFileName="UHF-WE~1.CSS")) returned 1 [0030.773] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 1 [0030.773] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 0 [0030.773] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0030.773] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e302e39, dwReserved1=0x2e72746c, cFileName="ABV8L7MY", cAlternateFileName="")) returned 1 [0030.773] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0030.775] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="..", cAlternateFileName="")) returned 1 [0030.776] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa36d90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa36d90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa83050, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xe455, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="000000929096[1].gif", cAlternateFileName="000000~1.GIF")) returned 1 [0030.776] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6384cac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6384cac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6384cac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2929, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="1223855322-postmessagerelay[1].js", cAlternateFileName="122385~1.JS")) returned 1 [0030.776] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA3e1oO[1].png", cAlternateFileName="AA3E1O~1.PNG")) returned 1 [0030.776] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png")) returned 0x2020 [0030.776] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.776] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.777] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x29b, lpOverlapped=0x0) returned 1 [0030.778] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x29b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x29b, lpOverlapped=0x0) returned 1 [0030.779] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.779] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.779] CloseHandle (hObject=0xf8) returned 1 [0030.779] CloseHandle (hObject=0x114) returned 1 [0030.780] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png.crypt")) returned 0 [0030.780] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png.crypt")) returned 0x2020 [0030.780] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA3e1oO[1].png", cAlternateFileName="AA3E1O~1.PNG")) returned 0x5c9000 [0030.780] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA3e1oO[1].png", cAlternateFileName="AA3E1O~1.PNG")) returned 0 [0030.780] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.781] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png")) returned 1 [0030.781] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png")) returned 0xffffffff [0030.781] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA429NP[1].png", cAlternateFileName="AA429N~1.PNG")) returned 1 [0030.782] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png")) returned 0x2020 [0030.782] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.782] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.782] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x265, lpOverlapped=0x0) returned 1 [0030.783] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x265, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x265, lpOverlapped=0x0) returned 1 [0030.784] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.784] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.784] CloseHandle (hObject=0x114) returned 1 [0030.784] CloseHandle (hObject=0xf8) returned 1 [0030.785] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png.crypt")) returned 0 [0030.785] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png.crypt")) returned 0x2020 [0030.785] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA429NP[1].png", cAlternateFileName="AA429N~1.PNG")) returned 0x5c9000 [0030.786] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459d37f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459d37f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459d37f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA429NP[1].png", cAlternateFileName="AA429N~1.PNG")) returned 0 [0030.786] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.786] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png")) returned 1 [0030.787] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png")) returned 0xffffffff [0030.787] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530fbfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA42pjY[1].png", cAlternateFileName="AA42PJ~1.PNG")) returned 1 [0030.787] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png")) returned 0x2020 [0030.787] VirtualAlloc (lpAddress=0x2a8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2a8000 [0030.787] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.788] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.788] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x252, lpOverlapped=0x0) returned 1 [0030.789] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x252, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x252, lpOverlapped=0x0) returned 1 [0030.790] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.790] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.790] CloseHandle (hObject=0xf8) returned 1 [0030.790] CloseHandle (hObject=0x114) returned 1 [0030.791] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png.crypt")) returned 0 [0030.791] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png.crypt")) returned 0x2020 [0030.791] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530fbfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA42pjY[1].png", cAlternateFileName="AA42PJ~1.PNG")) returned 0x5c9000 [0030.791] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530fbfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA42pjY[1].png", cAlternateFileName="AA42PJ~1.PNG")) returned 0 [0030.791] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.791] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png")) returned 1 [0030.792] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png")) returned 0xffffffff [0030.792] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe327870, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA61AKN[2].png", cAlternateFileName="AA61AK~2.PNG")) returned 1 [0030.792] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png")) returned 0x2020 [0030.793] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.793] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.794] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x248, lpOverlapped=0x0) returned 1 [0030.795] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x248, lpOverlapped=0x0) returned 1 [0030.796] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.796] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.796] CloseHandle (hObject=0x114) returned 1 [0030.796] CloseHandle (hObject=0xf8) returned 1 [0030.797] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png.crypt")) returned 0 [0030.797] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png.crypt")) returned 0x2020 [0030.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe327870, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA61AKN[2].png", cAlternateFileName="AA61AK~2.PNG")) returned 0x5c9000 [0030.797] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe327870, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA61AKN[2].png", cAlternateFileName="AA61AK~2.PNG")) returned 0 [0030.797] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.797] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png")) returned 1 [0030.798] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png")) returned 0xffffffff [0030.798] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA6KizP[2].png", cAlternateFileName="AA6KIZ~2.PNG")) returned 1 [0030.798] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png")) returned 0x2020 [0030.798] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.799] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.799] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x21b, lpOverlapped=0x0) returned 1 [0030.800] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x21b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x21b, lpOverlapped=0x0) returned 1 [0030.801] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.801] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.801] CloseHandle (hObject=0xf8) returned 1 [0030.801] CloseHandle (hObject=0x114) returned 1 [0030.802] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png.crypt")) returned 0 [0030.802] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png.crypt")) returned 0x2020 [0030.802] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA6KizP[2].png", cAlternateFileName="AA6KIZ~2.PNG")) returned 0x5c9000 [0030.802] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA6KizP[2].png", cAlternateFileName="AA6KIZ~2.PNG")) returned 0 [0030.803] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.803] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png")) returned 1 [0030.803] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png")) returned 0xffffffff [0030.804] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x27b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA7XCQ3[1].png", cAlternateFileName="AA7XCQ~1.PNG")) returned 1 [0030.804] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png")) returned 0x2020 [0030.804] VirtualAlloc (lpAddress=0x2ac000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2ac000 [0030.805] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.805] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.805] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x27b, lpOverlapped=0x0) returned 1 [0030.806] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x27b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x27b, lpOverlapped=0x0) returned 1 [0030.807] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.807] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.808] CloseHandle (hObject=0x114) returned 1 [0030.808] CloseHandle (hObject=0xf8) returned 1 [0030.808] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png.crypt")) returned 0 [0030.809] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png.crypt")) returned 0x2020 [0030.809] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x27b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA7XCQ3[1].png", cAlternateFileName="AA7XCQ~1.PNG")) returned 0x5c9000 [0030.809] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x27b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA7XCQ3[1].png", cAlternateFileName="AA7XCQ~1.PNG")) returned 0 [0030.809] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.809] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png")) returned 1 [0030.810] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png")) returned 0xffffffff [0030.810] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA8Tave[1].png", cAlternateFileName="AA8TAV~1.PNG")) returned 1 [0030.810] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png")) returned 0x2020 [0030.810] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.810] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.813] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x268, lpOverlapped=0x0) returned 1 [0030.814] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x268, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x268, lpOverlapped=0x0) returned 1 [0030.815] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.815] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.815] CloseHandle (hObject=0xf8) returned 1 [0030.815] CloseHandle (hObject=0x114) returned 1 [0030.817] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png.crypt")) returned 0 [0030.817] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png.crypt")) returned 0x2020 [0030.817] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA8Tave[1].png", cAlternateFileName="AA8TAV~1.PNG")) returned 0x5c9000 [0030.817] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA8Tave[1].png", cAlternateFileName="AA8TAV~1.PNG")) returned 0 [0030.817] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.817] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png")) returned 1 [0030.818] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png")) returned 0xffffffff [0030.818] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAfOIDq[1].png", cAlternateFileName="AAFOID~1.PNG")) returned 1 [0030.818] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png")) returned 0x2020 [0030.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.819] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.819] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x21e, lpOverlapped=0x0) returned 1 [0030.821] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x21e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x21e, lpOverlapped=0x0) returned 1 [0030.822] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.822] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.822] CloseHandle (hObject=0x114) returned 1 [0030.822] CloseHandle (hObject=0xf8) returned 1 [0030.823] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png.crypt")) returned 0 [0030.823] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png.crypt")) returned 0x2020 [0030.823] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAfOIDq[1].png", cAlternateFileName="AAFOID~1.PNG")) returned 0x5c9000 [0030.823] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAfOIDq[1].png", cAlternateFileName="AAFOID~1.PNG")) returned 0 [0030.823] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.823] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png")) returned 1 [0030.824] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png")) returned 0xffffffff [0030.824] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAkhMz9[2].png", cAlternateFileName="AAKHMZ~2.PNG")) returned 1 [0030.824] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png")) returned 0x2020 [0030.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.825] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2e3, lpOverlapped=0x0) returned 1 [0030.826] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2e3, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2e3, lpOverlapped=0x0) returned 1 [0030.827] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.827] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.827] CloseHandle (hObject=0xf8) returned 1 [0030.827] CloseHandle (hObject=0x114) returned 1 [0030.828] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png.crypt")) returned 0 [0030.828] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png.crypt")) returned 0x2020 [0030.828] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAkhMz9[2].png", cAlternateFileName="AAKHMZ~2.PNG")) returned 0x5c9000 [0030.828] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAkhMz9[2].png", cAlternateFileName="AAKHMZ~2.PNG")) returned 0 [0030.828] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.828] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png")) returned 1 [0030.829] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png")) returned 0xffffffff [0030.829] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAmRY2Q[1].png", cAlternateFileName="AAMRY2~1.PNG")) returned 1 [0030.829] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png")) returned 0x2020 [0030.831] VirtualAlloc (lpAddress=0x2b0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b0000 [0030.832] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.832] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.832] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x12c, lpOverlapped=0x0) returned 1 [0030.833] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x12c, lpOverlapped=0x0) returned 1 [0030.837] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.837] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.837] CloseHandle (hObject=0x114) returned 1 [0030.837] CloseHandle (hObject=0xf8) returned 1 [0030.838] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png.crypt")) returned 0 [0030.838] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png.crypt")) returned 0x2020 [0030.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAmRY2Q[1].png", cAlternateFileName="AAMRY2~1.PNG")) returned 0x5c9000 [0030.838] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAmRY2Q[1].png", cAlternateFileName="AAMRY2~1.PNG")) returned 0 [0030.838] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.839] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png")) returned 1 [0030.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png")) returned 0xffffffff [0030.840] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAni8qk[1].png", cAlternateFileName="AANI8Q~1.PNG")) returned 1 [0030.840] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png")) returned 0x2020 [0030.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.840] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x391, lpOverlapped=0x0) returned 1 [0030.842] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x391, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x391, lpOverlapped=0x0) returned 1 [0030.843] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.843] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.843] CloseHandle (hObject=0xf8) returned 1 [0030.843] CloseHandle (hObject=0x114) returned 1 [0030.844] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png.crypt")) returned 0 [0030.844] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png.crypt")) returned 0x2020 [0030.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAni8qk[1].png", cAlternateFileName="AANI8Q~1.PNG")) returned 0x5c9000 [0030.844] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAni8qk[1].png", cAlternateFileName="AANI8Q~1.PNG")) returned 0 [0030.844] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.845] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png")) returned 1 [0030.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png")) returned 0xffffffff [0030.846] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf1239b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf1239b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf1239b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7a52, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="adition[1].js", cAlternateFileName="ADITIO~1.JS")) returned 1 [0030.846] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c4a830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="async_usersync[1].htm", cAlternateFileName="ASYNC_~1.HTM")) returned 1 [0030.846] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bb22b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bb22b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bfe570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5feb, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", cAlternateFileName="B367C0~1.JPG")) returned 1 [0030.846] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg")) returned 0x2020 [0030.846] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.847] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.847] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.849] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.850] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.851] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.851] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.851] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.851] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.851] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.851] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.851] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.852] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xfeb, lpOverlapped=0x0) returned 1 [0030.852] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xfeb, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xfeb, lpOverlapped=0x0) returned 1 [0030.852] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.852] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.852] CloseHandle (hObject=0x114) returned 1 [0030.852] CloseHandle (hObject=0xf8) returned 1 [0030.853] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.crypt")) returned 0 [0030.853] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.crypt")) returned 0x2020 [0030.853] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bb22b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bb22b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bfe570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5feb, dwReserved0=0x5d6ff0, dwReserved1=0x18e59c, cFileName="b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", cAlternateFileName="B367C0~1.JPG")) returned 0x5c9000 [0030.853] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bb22b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bb22b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bfe570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5feb, dwReserved0=0x5d6ff0, dwReserved1=0x18e59c, cFileName="b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg", cAlternateFileName="B367C0~1.JPG")) returned 0 [0030.853] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.854] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg")) returned 1 [0030.854] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg")) returned 0xffffffff [0030.855] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BB8jcOr[2].png", cAlternateFileName="BB8JCO~2.PNG")) returned 1 [0030.855] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png")) returned 0x2020 [0030.855] VirtualAlloc (lpAddress=0x2b4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b4000 [0030.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.856] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1aa, lpOverlapped=0x0) returned 1 [0030.857] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1aa, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1aa, lpOverlapped=0x0) returned 1 [0030.858] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.858] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.858] CloseHandle (hObject=0xf8) returned 1 [0030.858] CloseHandle (hObject=0x114) returned 1 [0030.859] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png.crypt")) returned 0 [0030.859] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png.crypt")) returned 0x2020 [0030.860] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB8jcOr[2].png", cAlternateFileName="BB8JCO~2.PNG")) returned 0x5c9000 [0030.860] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB8jcOr[2].png", cAlternateFileName="BB8JCO~2.PNG")) returned 0 [0030.860] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.860] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png")) returned 1 [0030.861] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png")) returned 0xffffffff [0030.861] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c22, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBB8ZbM[1].jpg", cAlternateFileName="BBB8ZB~1.JPG")) returned 1 [0030.861] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg")) returned 0x2020 [0030.861] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.861] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.861] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.863] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.864] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xc22, lpOverlapped=0x0) returned 1 [0030.864] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xc22, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xc22, lpOverlapped=0x0) returned 1 [0030.865] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.865] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.865] CloseHandle (hObject=0x114) returned 1 [0030.865] CloseHandle (hObject=0xf8) returned 1 [0030.866] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg.crypt")) returned 0 [0030.866] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg.crypt")) returned 0x2020 [0030.866] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c22, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBB8ZbM[1].jpg", cAlternateFileName="BBB8ZB~1.JPG")) returned 0x5c9000 [0030.866] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c22, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBB8ZbM[1].jpg", cAlternateFileName="BBB8ZB~1.JPG")) returned 0 [0030.866] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.866] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg")) returned 1 [0030.867] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg")) returned 0xffffffff [0030.867] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBB9wH0[1].png", cAlternateFileName="BBB9WH~1.PNG")) returned 1 [0030.867] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png")) returned 0x2020 [0030.867] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.867] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.868] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x234, lpOverlapped=0x0) returned 1 [0030.869] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x234, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x234, lpOverlapped=0x0) returned 1 [0030.870] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.870] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.870] CloseHandle (hObject=0xf8) returned 1 [0030.870] CloseHandle (hObject=0x114) returned 1 [0030.871] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png.crypt")) returned 0 [0030.871] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png.crypt")) returned 0x2020 [0030.871] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBB9wH0[1].png", cAlternateFileName="BBB9WH~1.PNG")) returned 0x5c9000 [0030.871] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBB9wH0[1].png", cAlternateFileName="BBB9WH~1.PNG")) returned 0 [0030.871] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.871] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png")) returned 1 [0030.872] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png")) returned 0xffffffff [0030.872] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x642446e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x642446e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ac7, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBCFjo[1].jpg", cAlternateFileName="BBBCFJ~1.JPG")) returned 1 [0030.872] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg")) returned 0x2020 [0030.872] VirtualAlloc (lpAddress=0x2b8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2b8000 [0030.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.873] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.875] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.876] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.876] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.876] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xac7, lpOverlapped=0x0) returned 1 [0030.876] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xac7, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xac7, lpOverlapped=0x0) returned 1 [0030.877] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.877] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.877] CloseHandle (hObject=0x114) returned 1 [0030.877] CloseHandle (hObject=0xf8) returned 1 [0030.878] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg.crypt")) returned 0 [0030.878] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg.crypt")) returned 0x2020 [0030.878] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x642446e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x642446e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ac7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBCFjo[1].jpg", cAlternateFileName="BBBCFJ~1.JPG")) returned 0x5c9000 [0030.878] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x642446e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x642446e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x642446e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ac7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBCFjo[1].jpg", cAlternateFileName="BBBCFJ~1.JPG")) returned 0 [0030.878] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.878] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg")) returned 1 [0030.879] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg")) returned 0xffffffff [0030.879] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7c9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBDtcM[1].jpg", cAlternateFileName="BBBDTC~1.JPG")) returned 1 [0030.879] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg")) returned 0x2020 [0030.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.880] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.881] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7c9, lpOverlapped=0x0) returned 1 [0030.882] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7c9, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7c9, lpOverlapped=0x0) returned 1 [0030.883] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.883] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.883] CloseHandle (hObject=0xf8) returned 1 [0030.883] CloseHandle (hObject=0x114) returned 1 [0030.884] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg.crypt")) returned 0 [0030.884] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg.crypt")) returned 0x2020 [0030.884] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7c9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBDtcM[1].jpg", cAlternateFileName="BBBDTC~1.JPG")) returned 0x5c9000 [0030.885] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7c9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBDtcM[1].jpg", cAlternateFileName="BBBDTC~1.JPG")) returned 0 [0030.885] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.885] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg")) returned 1 [0030.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg")) returned 0xffffffff [0030.886] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f19, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBIeNJ[1].jpg", cAlternateFileName="BBBIEN~1.JPG")) returned 1 [0030.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg")) returned 0x2020 [0030.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.898] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.903] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.904] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xf19, lpOverlapped=0x0) returned 1 [0030.904] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xf19, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xf19, lpOverlapped=0x0) returned 1 [0030.904] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.904] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.904] CloseHandle (hObject=0x114) returned 1 [0030.904] CloseHandle (hObject=0xf8) returned 1 [0030.905] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg.crypt")) returned 0 [0030.906] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg.crypt")) returned 0x2020 [0030.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f19, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBIeNJ[1].jpg", cAlternateFileName="BBBIEN~1.JPG")) returned 0x5c9000 [0030.906] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f19, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBIeNJ[1].jpg", cAlternateFileName="BBBIEN~1.JPG")) returned 0 [0030.906] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.906] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg")) returned 1 [0030.907] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg")) returned 0xffffffff [0030.907] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53598a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBImKX[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 1 [0030.907] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg")) returned 0x2020 [0030.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.908] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x711, lpOverlapped=0x0) returned 1 [0030.909] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x711, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x711, lpOverlapped=0x0) returned 1 [0030.910] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.910] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.910] CloseHandle (hObject=0xf8) returned 1 [0030.910] CloseHandle (hObject=0x114) returned 1 [0030.912] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg.crypt")) returned 0 [0030.912] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg.crypt")) returned 0x2020 [0030.912] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53598a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBImKX[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 0x5c9000 [0030.913] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53598a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBImKX[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 0 [0030.913] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.913] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg")) returned 1 [0030.914] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg")) returned 0xffffffff [0030.914] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2569, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBL4R9[1].jpg", cAlternateFileName="BBBL4R~1.JPG")) returned 1 [0030.914] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg")) returned 0x2020 [0030.914] VirtualAlloc (lpAddress=0x2bc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2bc000 [0030.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.915] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.917] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.917] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.918] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.918] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x569, lpOverlapped=0x0) returned 1 [0030.918] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x569, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x569, lpOverlapped=0x0) returned 1 [0030.918] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.918] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.918] CloseHandle (hObject=0x114) returned 1 [0030.918] CloseHandle (hObject=0xf8) returned 1 [0030.919] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg.crypt")) returned 0 [0030.920] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg.crypt")) returned 0x2020 [0030.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2569, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBL4R9[1].jpg", cAlternateFileName="BBBL4R~1.JPG")) returned 0x5c9000 [0030.920] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2569, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBL4R9[1].jpg", cAlternateFileName="BBBL4R~1.JPG")) returned 0 [0030.920] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.920] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg")) returned 1 [0030.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg")) returned 0xffffffff [0030.921] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBLhTZ[1].jpg", cAlternateFileName="BBBLHT~1.JPG")) returned 1 [0030.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg")) returned 0x2020 [0030.922] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.922] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.922] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.924] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.925] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.925] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.926] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.926] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.926] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xd2, lpOverlapped=0x0) returned 1 [0030.926] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xd2, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xd2, lpOverlapped=0x0) returned 1 [0030.926] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.926] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.926] CloseHandle (hObject=0xf8) returned 1 [0030.926] CloseHandle (hObject=0x114) returned 1 [0030.927] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg.crypt")) returned 0 [0030.927] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg.crypt")) returned 0x2020 [0030.927] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBLhTZ[1].jpg", cAlternateFileName="BBBLHT~1.JPG")) returned 0x5c9000 [0030.927] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBLhTZ[1].jpg", cAlternateFileName="BBBLHT~1.JPG")) returned 0 [0030.928] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.928] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg")) returned 1 [0030.929] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg")) returned 0xffffffff [0030.929] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9b9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBnhZY[1].jpg", cAlternateFileName="BBBNHZ~1.JPG")) returned 1 [0030.929] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg")) returned 0x2020 [0030.929] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.930] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.930] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9b9, lpOverlapped=0x0) returned 1 [0030.931] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9b9, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9b9, lpOverlapped=0x0) returned 1 [0030.932] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.932] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.932] CloseHandle (hObject=0x114) returned 1 [0030.932] CloseHandle (hObject=0xf8) returned 1 [0030.933] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg.crypt")) returned 0 [0030.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg.crypt")) returned 0x2020 [0030.933] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9b9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBnhZY[1].jpg", cAlternateFileName="BBBNHZ~1.JPG")) returned 0x5c9000 [0030.933] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9b9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBnhZY[1].jpg", cAlternateFileName="BBBNHZ~1.JPG")) returned 0 [0030.933] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.933] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg")) returned 1 [0030.934] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg")) returned 0xffffffff [0030.934] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x671dfee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x671dfee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x67206040, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f4, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBPhAr[1].jpg", cAlternateFileName="BBBPHA~1.JPG")) returned 1 [0030.934] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg")) returned 0x2020 [0030.935] VirtualAlloc (lpAddress=0x2c0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2c0000 [0030.935] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.935] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.935] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.938] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.939] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.939] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.939] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.939] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.939] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.940] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.940] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x8f4, lpOverlapped=0x0) returned 1 [0030.940] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x8f4, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x8f4, lpOverlapped=0x0) returned 1 [0030.940] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.940] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.940] CloseHandle (hObject=0xf8) returned 1 [0030.940] CloseHandle (hObject=0x114) returned 1 [0030.941] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg.crypt")) returned 0 [0030.941] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg.crypt")) returned 0x2020 [0030.941] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x671dfee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x671dfee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x67206040, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f4, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPhAr[1].jpg", cAlternateFileName="BBBPHA~1.JPG")) returned 0x5c9000 [0030.941] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x671dfee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x671dfee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x67206040, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f4, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPhAr[1].jpg", cAlternateFileName="BBBPHA~1.JPG")) returned 0 [0030.941] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.941] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg")) returned 1 [0030.942] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg")) returned 0xffffffff [0030.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c21, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBPiby[1].jpg", cAlternateFileName="BBBPIB~1.JPG")) returned 1 [0030.942] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg")) returned 0x2020 [0030.943] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.943] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.943] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.945] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.946] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xc21, lpOverlapped=0x0) returned 1 [0030.946] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xc21, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xc21, lpOverlapped=0x0) returned 1 [0030.946] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.946] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.947] CloseHandle (hObject=0x114) returned 1 [0030.947] CloseHandle (hObject=0xf8) returned 1 [0030.948] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg.crypt")) returned 0 [0030.948] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg.crypt")) returned 0x2020 [0030.948] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c21, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPiby[1].jpg", cAlternateFileName="BBBPIB~1.JPG")) returned 0x5c9000 [0030.948] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c21, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPiby[1].jpg", cAlternateFileName="BBBPIB~1.JPG")) returned 0 [0030.948] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.948] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg")) returned 1 [0030.949] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg")) returned 0xffffffff [0030.949] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16bf, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBPmXJ[1].jpg", cAlternateFileName="BBBPMX~1.JPG")) returned 1 [0030.949] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg")) returned 0x2020 [0030.949] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.950] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.952] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.953] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x6bf, lpOverlapped=0x0) returned 1 [0030.953] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x6bf, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x6bf, lpOverlapped=0x0) returned 1 [0030.953] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.953] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.953] CloseHandle (hObject=0xf8) returned 1 [0030.953] CloseHandle (hObject=0x114) returned 1 [0030.954] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg.crypt")) returned 0 [0030.954] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg.crypt")) returned 0x2020 [0030.954] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16bf, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPmXJ[1].jpg", cAlternateFileName="BBBPMX~1.JPG")) returned 0x5c9000 [0030.955] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16bf, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPmXJ[1].jpg", cAlternateFileName="BBBPMX~1.JPG")) returned 0 [0030.955] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.955] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg")) returned 1 [0030.956] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg")) returned 0xffffffff [0030.956] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21feb, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBPS37[1].png", cAlternateFileName="BBBPS3~1.PNG")) returned 1 [0030.956] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png")) returned 0x2020 [0030.956] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.956] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.956] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.958] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.960] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.960] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.960] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.961] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.961] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.961] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.961] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.961] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.961] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.962] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.962] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.962] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.962] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.962] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.962] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.962] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.963] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.963] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.963] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.963] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.963] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.963] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.964] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.964] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.964] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.964] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.964] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.964] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.965] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.965] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.965] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.965] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.965] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.965] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.965] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.966] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.967] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.967] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.967] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.967] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.967] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.968] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.968] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.968] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.968] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.968] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.968] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.969] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.969] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.969] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.969] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.969] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.969] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.969] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.970] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.970] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.970] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.970] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.970] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.970] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.970] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.971] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.971] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.971] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.971] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xfeb, lpOverlapped=0x0) returned 1 [0030.971] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xfeb, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xfeb, lpOverlapped=0x0) returned 1 [0030.971] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.971] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.971] CloseHandle (hObject=0x114) returned 1 [0030.972] CloseHandle (hObject=0xf8) returned 1 [0030.973] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png.crypt")) returned 0 [0030.974] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png.crypt")) returned 0x2020 [0030.974] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21feb, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPS37[1].png", cAlternateFileName="BBBPS3~1.PNG")) returned 0x5c9000 [0030.974] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530d5e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530d5e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21feb, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPS37[1].png", cAlternateFileName="BBBPS3~1.PNG")) returned 0 [0030.974] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.974] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png")) returned 1 [0030.977] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png")) returned 0xffffffff [0030.977] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBQiBF[1].jpg", cAlternateFileName="BBBQIB~1.JPG")) returned 1 [0030.987] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg")) returned 0x2020 [0030.987] VirtualAlloc (lpAddress=0x2c4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2c4000 [0030.988] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.988] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.988] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.990] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0030.991] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2f9, lpOverlapped=0x0) returned 1 [0030.991] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2f9, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2f9, lpOverlapped=0x0) returned 1 [0030.992] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.992] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.992] CloseHandle (hObject=0xf8) returned 1 [0030.992] CloseHandle (hObject=0x114) returned 1 [0030.993] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg.crypt")) returned 0 [0030.993] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg.crypt")) returned 0x2020 [0030.993] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBQiBF[1].jpg", cAlternateFileName="BBBQIB~1.JPG")) returned 0x5c9000 [0030.993] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBQiBF[1].jpg", cAlternateFileName="BBBQIB~1.JPG")) returned 0 [0030.993] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.993] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg")) returned 1 [0030.994] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg")) returned 0xffffffff [0030.994] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBty8h[1].jpg", cAlternateFileName="BBBTY8~1.JPG")) returned 1 [0030.994] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg")) returned 0x2020 [0030.995] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0030.995] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0030.995] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9a9, lpOverlapped=0x0) returned 1 [0030.996] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9a9, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9a9, lpOverlapped=0x0) returned 1 [0030.997] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.997] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0030.997] CloseHandle (hObject=0x114) returned 1 [0030.998] CloseHandle (hObject=0xf8) returned 1 [0030.998] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg.crypt")) returned 0 [0030.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg.crypt")) returned 0x2020 [0030.999] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBty8h[1].jpg", cAlternateFileName="BBBTY8~1.JPG")) returned 0x5c9000 [0030.999] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533cf9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533cf9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533cf9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBty8h[1].jpg", cAlternateFileName="BBBTY8~1.JPG")) returned 0 [0030.999] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0030.999] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg")) returned 1 [0031.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg")) returned 0xffffffff [0031.000] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBVACL[1].jpg", cAlternateFileName="BBBVAC~1.JPG")) returned 1 [0031.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg")) returned 0x2020 [0031.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.001] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.001] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.003] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.005] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xb08, lpOverlapped=0x0) returned 1 [0031.005] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xb08, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xb08, lpOverlapped=0x0) returned 1 [0031.005] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.005] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.005] CloseHandle (hObject=0xf8) returned 1 [0031.005] CloseHandle (hObject=0x114) returned 1 [0031.006] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg.crypt")) returned 0 [0031.007] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg.crypt")) returned 0x2020 [0031.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVACL[1].jpg", cAlternateFileName="BBBVAC~1.JPG")) returned 0x5c9000 [0031.007] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5303d8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5303d8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5303d8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVACL[1].jpg", cAlternateFileName="BBBVAC~1.JPG")) returned 0 [0031.007] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.007] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg")) returned 1 [0031.008] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg")) returned 0xffffffff [0031.008] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e29b2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e29b2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e29b2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c41, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBVGyR[1].jpg", cAlternateFileName="BBBVGY~1.JPG")) returned 1 [0031.008] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg")) returned 0x2020 [0031.008] VirtualAlloc (lpAddress=0x2c8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2c8000 [0031.008] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.009] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.009] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.011] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.011] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xc41, lpOverlapped=0x0) returned 1 [0031.012] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xc41, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xc41, lpOverlapped=0x0) returned 1 [0031.012] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.012] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.012] CloseHandle (hObject=0x114) returned 1 [0031.012] CloseHandle (hObject=0xf8) returned 1 [0031.013] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg.crypt")) returned 0 [0031.013] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg.crypt")) returned 0x2020 [0031.013] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e29b2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e29b2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e29b2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c41, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVGyR[1].jpg", cAlternateFileName="BBBVGY~1.JPG")) returned 0x5c9000 [0031.013] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e29b2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e29b2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e29b2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c41, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVGyR[1].jpg", cAlternateFileName="BBBVGY~1.JPG")) returned 0 [0031.013] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.013] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg")) returned 1 [0031.014] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVGyR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvgyr[1].jpg")) returned 0xffffffff [0031.014] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBVMtX[1].jpg", cAlternateFileName="BBBVMT~1.JPG")) returned 1 [0031.014] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg")) returned 0x2020 [0031.015] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.015] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.016] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x950, lpOverlapped=0x0) returned 1 [0031.017] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x950, lpOverlapped=0x0) returned 1 [0031.018] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.018] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.018] CloseHandle (hObject=0xf8) returned 1 [0031.018] CloseHandle (hObject=0x114) returned 1 [0031.019] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg.crypt")) returned 0 [0031.019] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg.crypt")) returned 0x2020 [0031.019] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVMtX[1].jpg", cAlternateFileName="BBBVMT~1.JPG")) returned 0x5c9000 [0031.020] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVMtX[1].jpg", cAlternateFileName="BBBVMT~1.JPG")) returned 0 [0031.020] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.020] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg")) returned 1 [0031.021] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVMtX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvmtx[1].jpg")) returned 0xffffffff [0031.021] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBVYsu[1].jpg", cAlternateFileName="BBBVYS~1.JPG")) returned 1 [0031.021] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg")) returned 0x2020 [0031.022] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.022] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.022] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.028] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.029] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xbba, lpOverlapped=0x0) returned 1 [0031.029] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xbba, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xbba, lpOverlapped=0x0) returned 1 [0031.029] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.029] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.029] CloseHandle (hObject=0x114) returned 1 [0031.029] CloseHandle (hObject=0xf8) returned 1 [0031.030] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg.crypt")) returned 0 [0031.031] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg.crypt")) returned 0x2020 [0031.031] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVYsu[1].jpg", cAlternateFileName="BBBVYS~1.JPG")) returned 0x5c9000 [0031.031] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVYsu[1].jpg", cAlternateFileName="BBBVYS~1.JPG")) returned 0 [0031.031] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.031] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg")) returned 1 [0031.032] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVYsu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvysu[1].jpg")) returned 0xffffffff [0031.032] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5154fff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5154fff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51576150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x76a, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBWLtW[1].jpg", cAlternateFileName="BBBWLT~1.JPG")) returned 1 [0031.032] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg")) returned 0x2020 [0031.034] VirtualAlloc (lpAddress=0x2cc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2cc000 [0031.034] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.034] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.034] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x76a, lpOverlapped=0x0) returned 1 [0031.036] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x76a, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x76a, lpOverlapped=0x0) returned 1 [0031.037] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.037] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.037] CloseHandle (hObject=0xf8) returned 1 [0031.037] CloseHandle (hObject=0x114) returned 1 [0031.038] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg.crypt")) returned 0 [0031.038] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg.crypt")) returned 0x2020 [0031.038] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5154fff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5154fff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51576150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x76a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBWLtW[1].jpg", cAlternateFileName="BBBWLT~1.JPG")) returned 0x5c9000 [0031.038] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5154fff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5154fff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51576150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x76a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBWLtW[1].jpg", cAlternateFileName="BBBWLT~1.JPG")) returned 0 [0031.038] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.038] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg")) returned 1 [0031.039] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBWLtW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbwltw[1].jpg")) returned 0xffffffff [0031.039] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBX3xB[1].jpg", cAlternateFileName="BBBX3X~1.JPG")) returned 1 [0031.039] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg")) returned 0x2020 [0031.040] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.040] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.040] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x95f, lpOverlapped=0x0) returned 1 [0031.042] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x95f, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x95f, lpOverlapped=0x0) returned 1 [0031.043] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.043] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.043] CloseHandle (hObject=0x114) returned 1 [0031.043] CloseHandle (hObject=0xf8) returned 1 [0031.043] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg.crypt")) returned 0 [0031.044] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg.crypt")) returned 0x2020 [0031.044] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBX3xB[1].jpg", cAlternateFileName="BBBX3X~1.JPG")) returned 0x5c9000 [0031.044] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBX3xB[1].jpg", cAlternateFileName="BBBX3X~1.JPG")) returned 0 [0031.044] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.044] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg")) returned 1 [0031.045] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBX3xB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbx3xb[1].jpg")) returned 0xffffffff [0031.045] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533112f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533112f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533112f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x241e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBY98e[1].jpg", cAlternateFileName="BBBY98~1.JPG")) returned 1 [0031.045] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg")) returned 0x2020 [0031.046] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.046] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.046] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.048] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.049] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.049] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.049] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x41e, lpOverlapped=0x0) returned 1 [0031.049] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x41e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x41e, lpOverlapped=0x0) returned 1 [0031.049] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.049] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.049] CloseHandle (hObject=0xf8) returned 1 [0031.049] CloseHandle (hObject=0x114) returned 1 [0031.050] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg.crypt")) returned 0 [0031.050] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg.crypt")) returned 0x2020 [0031.051] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533112f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533112f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533112f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x241e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBY98e[1].jpg", cAlternateFileName="BBBY98~1.JPG")) returned 0x5c9000 [0031.051] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533112f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533112f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533112f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x241e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBY98e[1].jpg", cAlternateFileName="BBBY98~1.JPG")) returned 0 [0031.051] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.051] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg")) returned 1 [0031.052] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBY98e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbby98e[1].jpg")) returned 0xffffffff [0031.052] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBZYVP[1].jpg", cAlternateFileName="BBBZYV~1.JPG")) returned 1 [0031.052] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg")) returned 0x2020 [0031.052] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.052] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.052] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x938, lpOverlapped=0x0) returned 1 [0031.054] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x938, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x938, lpOverlapped=0x0) returned 1 [0031.055] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.055] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.055] CloseHandle (hObject=0x114) returned 1 [0031.055] CloseHandle (hObject=0xf8) returned 1 [0031.056] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg.crypt")) returned 0 [0031.056] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg.crypt")) returned 0x2020 [0031.056] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBZYVP[1].jpg", cAlternateFileName="BBBZYV~1.JPG")) returned 0x5c9000 [0031.057] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBZYVP[1].jpg", cAlternateFileName="BBBZYV~1.JPG")) returned 0 [0031.057] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.057] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg")) returned 1 [0031.058] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBZYVP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbzyvp[1].jpg")) returned 0xffffffff [0031.058] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x192a, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 1 [0031.058] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg")) returned 0x2020 [0031.058] VirtualAlloc (lpAddress=0x2d0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2d0000 [0031.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.059] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.060] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.061] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x92a, lpOverlapped=0x0) returned 1 [0031.062] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x92a, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x92a, lpOverlapped=0x0) returned 1 [0031.062] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.062] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.062] CloseHandle (hObject=0xf8) returned 1 [0031.062] CloseHandle (hObject=0x114) returned 1 [0031.062] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg.crypt")) returned 0 [0031.063] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg.crypt")) returned 0x2020 [0031.063] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x192a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 0x5c9000 [0031.063] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x192a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 0 [0031.063] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.063] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg")) returned 1 [0031.064] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04o2[1].jpg")) returned 0xffffffff [0031.064] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23fb, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC04ok[1].jpg", cAlternateFileName="BBC04O~2.JPG")) returned 1 [0031.064] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg")) returned 0x2020 [0031.064] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.065] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.065] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.154] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.155] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.155] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.155] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x3fb, lpOverlapped=0x0) returned 1 [0031.155] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x3fb, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x3fb, lpOverlapped=0x0) returned 1 [0031.155] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.155] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.155] CloseHandle (hObject=0x114) returned 1 [0031.155] CloseHandle (hObject=0xf8) returned 1 [0031.157] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg.crypt")) returned 0 [0031.157] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg.crypt")) returned 0x2020 [0031.157] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23fb, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC04ok[1].jpg", cAlternateFileName="BBC04O~2.JPG")) returned 0x5c9000 [0031.157] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23fb, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC04ok[1].jpg", cAlternateFileName="BBC04O~2.JPG")) returned 0 [0031.157] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.157] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg")) returned 1 [0031.158] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04ok[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04ok[1].jpg")) returned 0xffffffff [0031.158] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539e9230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a99, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC04we[1].jpg", cAlternateFileName="BBC04W~1.JPG")) returned 1 [0031.158] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg")) returned 0x2020 [0031.159] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.159] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.159] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.161] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.162] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.164] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.164] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xa99, lpOverlapped=0x0) returned 1 [0031.165] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xa99, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xa99, lpOverlapped=0x0) returned 1 [0031.165] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.165] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.165] CloseHandle (hObject=0xf8) returned 1 [0031.165] CloseHandle (hObject=0x114) returned 1 [0031.166] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg.crypt")) returned 0 [0031.166] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg.crypt")) returned 0x2020 [0031.166] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539e9230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a99, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC04we[1].jpg", cAlternateFileName="BBC04W~1.JPG")) returned 0x5c9000 [0031.166] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539e9230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a99, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC04we[1].jpg", cAlternateFileName="BBC04W~1.JPG")) returned 0 [0031.166] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.166] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg")) returned 1 [0031.167] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC04we[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc04we[1].jpg")) returned 0xffffffff [0031.167] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e02430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e02430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC05rl[1].jpg", cAlternateFileName="BBC05R~1.JPG")) returned 1 [0031.167] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg")) returned 0x2020 [0031.168] VirtualAlloc (lpAddress=0x2d4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2d4000 [0031.168] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.169] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.169] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.171] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.172] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.172] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.172] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.172] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.172] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x200, lpOverlapped=0x0) returned 1 [0031.172] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x200, lpOverlapped=0x0) returned 1 [0031.173] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.173] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.173] CloseHandle (hObject=0x114) returned 1 [0031.173] CloseHandle (hObject=0xf8) returned 1 [0031.174] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg.crypt")) returned 0 [0031.174] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg.crypt")) returned 0x2020 [0031.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e02430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e02430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC05rl[1].jpg", cAlternateFileName="BBC05R~1.JPG")) returned 0x5c9000 [0031.174] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e02430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e02430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC05rl[1].jpg", cAlternateFileName="BBC05R~1.JPG")) returned 0 [0031.174] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.174] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg")) returned 1 [0031.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[1].jpg")) returned 0xffffffff [0031.175] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC05rl[2].jpg", cAlternateFileName="BBC05R~2.JPG")) returned 1 [0031.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg")) returned 0x2020 [0031.176] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.176] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.176] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7e1, lpOverlapped=0x0) returned 1 [0031.178] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7e1, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7e1, lpOverlapped=0x0) returned 1 [0031.179] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.179] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.179] CloseHandle (hObject=0xf8) returned 1 [0031.179] CloseHandle (hObject=0x114) returned 1 [0031.179] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg.crypt")) returned 0 [0031.180] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg.crypt")) returned 0x2020 [0031.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC05rl[2].jpg", cAlternateFileName="BBC05R~2.JPG")) returned 0x5c9000 [0031.180] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC05rl[2].jpg", cAlternateFileName="BBC05R~2.JPG")) returned 0 [0031.180] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.180] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg")) returned 1 [0031.181] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC05rl[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc05rl[2].jpg")) returned 0xffffffff [0031.181] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b4e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0ATj[1].jpg", cAlternateFileName="BBC0AT~1.JPG")) returned 1 [0031.181] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg")) returned 0x2020 [0031.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.184] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.186] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.187] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xb4e, lpOverlapped=0x0) returned 1 [0031.187] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xb4e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xb4e, lpOverlapped=0x0) returned 1 [0031.187] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.188] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.188] CloseHandle (hObject=0x114) returned 1 [0031.188] CloseHandle (hObject=0xf8) returned 1 [0031.188] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg.crypt")) returned 0 [0031.189] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg.crypt")) returned 0x2020 [0031.189] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b4e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0ATj[1].jpg", cAlternateFileName="BBC0AT~1.JPG")) returned 0x5c9000 [0031.189] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ff1610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ff1610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ff1610, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b4e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0ATj[1].jpg", cAlternateFileName="BBC0AT~1.JPG")) returned 0 [0031.189] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.189] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg")) returned 1 [0031.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0ATj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0atj[1].jpg")) returned 0xffffffff [0031.190] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x751, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0D8i[1].jpg", cAlternateFileName="BBC0D8~1.JPG")) returned 1 [0031.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg")) returned 0x2020 [0031.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.191] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x751, lpOverlapped=0x0) returned 1 [0031.196] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x751, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x751, lpOverlapped=0x0) returned 1 [0031.197] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.197] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.197] CloseHandle (hObject=0xf8) returned 1 [0031.197] CloseHandle (hObject=0x114) returned 1 [0031.198] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg.crypt")) returned 0 [0031.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg.crypt")) returned 0x2020 [0031.198] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x751, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0D8i[1].jpg", cAlternateFileName="BBC0D8~1.JPG")) returned 0x5c9000 [0031.198] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x751, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0D8i[1].jpg", cAlternateFileName="BBC0D8~1.JPG")) returned 0 [0031.198] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.199] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg")) returned 1 [0031.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0D8i[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0d8i[1].jpg")) returned 0xffffffff [0031.199] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 1 [0031.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg")) returned 0x2020 [0031.200] VirtualAlloc (lpAddress=0x2d8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2d8000 [0031.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.200] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.202] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.203] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.203] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.203] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xe, lpOverlapped=0x0) returned 1 [0031.204] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xe, lpOverlapped=0x0) returned 1 [0031.204] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.204] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.204] CloseHandle (hObject=0x114) returned 1 [0031.204] CloseHandle (hObject=0xf8) returned 1 [0031.205] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg.crypt")) returned 0 [0031.205] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg.crypt")) returned 0x2020 [0031.205] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 0x5c9000 [0031.205] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 0 [0031.205] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.205] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg")) returned 1 [0031.206] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0g7a[1].jpg")) returned 0xffffffff [0031.206] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0w1b[1].jpg", cAlternateFileName="BBC0W1~1.JPG")) returned 1 [0031.206] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg")) returned 0x2020 [0031.207] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.207] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.207] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.209] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.210] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xdcb, lpOverlapped=0x0) returned 1 [0031.210] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xdcb, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xdcb, lpOverlapped=0x0) returned 1 [0031.210] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.210] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.210] CloseHandle (hObject=0xf8) returned 1 [0031.211] CloseHandle (hObject=0x114) returned 1 [0031.211] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg.crypt")) returned 0 [0031.212] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg.crypt")) returned 0x2020 [0031.212] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0w1b[1].jpg", cAlternateFileName="BBC0W1~1.JPG")) returned 0x5c9000 [0031.212] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0w1b[1].jpg", cAlternateFileName="BBC0W1~1.JPG")) returned 0 [0031.212] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.212] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg")) returned 1 [0031.213] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0w1b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0w1b[1].jpg")) returned 0xffffffff [0031.213] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23ba, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0xLt[1].jpg", cAlternateFileName="BBC0XL~1.JPG")) returned 1 [0031.213] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg")) returned 0x2020 [0031.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.214] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.215] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.216] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.216] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.217] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x3ba, lpOverlapped=0x0) returned 1 [0031.217] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x3ba, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x3ba, lpOverlapped=0x0) returned 1 [0031.217] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.217] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.217] CloseHandle (hObject=0x114) returned 1 [0031.217] CloseHandle (hObject=0xf8) returned 1 [0031.218] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg.crypt")) returned 0 [0031.218] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg.crypt")) returned 0x2020 [0031.218] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23ba, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0xLt[1].jpg", cAlternateFileName="BBC0XL~1.JPG")) returned 0x5c9000 [0031.218] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23ba, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0xLt[1].jpg", cAlternateFileName="BBC0XL~1.JPG")) returned 0 [0031.218] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.218] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg")) returned 1 [0031.219] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBC0xLt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbc0xlt[1].jpg")) returned 0xffffffff [0031.219] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBDWA22[1].jpg", cAlternateFileName="BBDWA2~1.JPG")) returned 1 [0031.219] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg")) returned 0x2020 [0031.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.220] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.221] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xb58, lpOverlapped=0x0) returned 1 [0031.222] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xb58, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xb58, lpOverlapped=0x0) returned 1 [0031.223] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.223] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.223] CloseHandle (hObject=0xf8) returned 1 [0031.223] CloseHandle (hObject=0x114) returned 1 [0031.224] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg.crypt")) returned 0 [0031.224] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg.crypt")) returned 0x2020 [0031.224] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDWA22[1].jpg", cAlternateFileName="BBDWA2~1.JPG")) returned 0x5c9000 [0031.224] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDWA22[1].jpg", cAlternateFileName="BBDWA2~1.JPG")) returned 0 [0031.224] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.225] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg")) returned 1 [0031.225] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBDWA22[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbdwa22[1].jpg")) returned 0xffffffff [0031.225] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBE7d3b[1].jpg", cAlternateFileName="BBE7D3~1.JPG")) returned 1 [0031.226] VirtualAlloc (lpAddress=0x2dc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2dc000 [0031.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg")) returned 0x2020 [0031.229] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.230] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.230] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x91d, lpOverlapped=0x0) returned 1 [0031.231] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x91d, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x91d, lpOverlapped=0x0) returned 1 [0031.232] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.232] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.232] CloseHandle (hObject=0x114) returned 1 [0031.232] CloseHandle (hObject=0xf8) returned 1 [0031.233] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg.crypt")) returned 0 [0031.233] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg.crypt")) returned 0x2020 [0031.233] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE7d3b[1].jpg", cAlternateFileName="BBE7D3~1.JPG")) returned 0x5c9000 [0031.233] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE7d3b[1].jpg", cAlternateFileName="BBE7D3~1.JPG")) returned 0 [0031.233] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.233] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg")) returned 1 [0031.234] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE7d3b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe7d3b[1].jpg")) returned 0xffffffff [0031.234] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45583010, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45583010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455a9170, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2850, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBE85ld[1].jpg", cAlternateFileName="BBE85L~1.JPG")) returned 1 [0031.234] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg")) returned 0x2020 [0031.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.235] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.238] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.238] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.239] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.239] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x850, lpOverlapped=0x0) returned 1 [0031.239] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x850, lpOverlapped=0x0) returned 1 [0031.239] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.239] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.239] CloseHandle (hObject=0xf8) returned 1 [0031.239] CloseHandle (hObject=0x114) returned 1 [0031.240] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg.crypt")) returned 0 [0031.240] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg.crypt")) returned 0x2020 [0031.240] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45583010, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45583010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455a9170, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2850, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE85ld[1].jpg", cAlternateFileName="BBE85L~1.JPG")) returned 0x5c9000 [0031.240] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45583010, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45583010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455a9170, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2850, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE85ld[1].jpg", cAlternateFileName="BBE85L~1.JPG")) returned 0 [0031.240] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.241] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg")) returned 1 [0031.241] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBE85ld[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbe85ld[1].jpg")) returned 0xffffffff [0031.242] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x16ca, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEdckp[1].jpg", cAlternateFileName="BBEDCK~1.JPG")) returned 1 [0031.242] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg")) returned 0x2020 [0031.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.242] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.244] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.245] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x6ca, lpOverlapped=0x0) returned 1 [0031.245] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x6ca, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x6ca, lpOverlapped=0x0) returned 1 [0031.245] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.245] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.245] CloseHandle (hObject=0x114) returned 1 [0031.245] CloseHandle (hObject=0xf8) returned 1 [0031.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg.crypt")) returned 0 [0031.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg.crypt")) returned 0x2020 [0031.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x16ca, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdckp[1].jpg", cAlternateFileName="BBEDCK~1.JPG")) returned 0x5c9000 [0031.247] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x16ca, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdckp[1].jpg", cAlternateFileName="BBEDCK~1.JPG")) returned 0 [0031.247] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.247] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg")) returned 1 [0031.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdckp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedckp[1].jpg")) returned 0xffffffff [0031.248] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEdMci[1].jpg", cAlternateFileName="BBEDMC~1.JPG")) returned 1 [0031.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg")) returned 0x2020 [0031.248] VirtualAlloc (lpAddress=0x2e0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2e0000 [0031.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.249] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xafe, lpOverlapped=0x0) returned 1 [0031.250] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xafe, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xafe, lpOverlapped=0x0) returned 1 [0031.251] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.251] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.251] CloseHandle (hObject=0xf8) returned 1 [0031.251] CloseHandle (hObject=0x114) returned 1 [0031.252] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg.crypt")) returned 0 [0031.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg.crypt")) returned 0x2020 [0031.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdMci[1].jpg", cAlternateFileName="BBEDMC~1.JPG")) returned 0x5c9000 [0031.252] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdMci[1].jpg", cAlternateFileName="BBEDMC~1.JPG")) returned 0 [0031.252] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.252] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg")) returned 1 [0031.253] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdMci[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedmci[1].jpg")) returned 0xffffffff [0031.253] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a48, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEdSLV[1].jpg", cAlternateFileName="BBEDSL~1.JPG")) returned 1 [0031.253] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg")) returned 0x2020 [0031.253] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.254] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.256] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.257] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.257] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.257] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xa48, lpOverlapped=0x0) returned 1 [0031.257] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xa48, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xa48, lpOverlapped=0x0) returned 1 [0031.257] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.257] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.258] CloseHandle (hObject=0x114) returned 1 [0031.258] CloseHandle (hObject=0xf8) returned 1 [0031.258] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg.crypt")) returned 0 [0031.259] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg.crypt")) returned 0x2020 [0031.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a48, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdSLV[1].jpg", cAlternateFileName="BBEDSL~1.JPG")) returned 0x5c9000 [0031.259] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a48, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdSLV[1].jpg", cAlternateFileName="BBEDSL~1.JPG")) returned 0 [0031.259] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.259] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg")) returned 1 [0031.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEdSLV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbedslv[1].jpg")) returned 0xffffffff [0031.260] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEe2Pd[1].jpg", cAlternateFileName="BBEE2P~1.JPG")) returned 1 [0031.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg")) returned 0x2020 [0031.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.261] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x87f, lpOverlapped=0x0) returned 1 [0031.262] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x87f, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x87f, lpOverlapped=0x0) returned 1 [0031.263] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.263] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.263] CloseHandle (hObject=0xf8) returned 1 [0031.263] CloseHandle (hObject=0x114) returned 1 [0031.264] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg.crypt")) returned 0 [0031.264] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg.crypt")) returned 0x2020 [0031.264] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEe2Pd[1].jpg", cAlternateFileName="BBEE2P~1.JPG")) returned 0x5c9000 [0031.264] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEe2Pd[1].jpg", cAlternateFileName="BBEE2P~1.JPG")) returned 0 [0031.264] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.265] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg")) returned 1 [0031.265] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe2Pd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee2pd[1].jpg")) returned 0xffffffff [0031.266] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3faf, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEe4Oo[1].png", cAlternateFileName="BBEE4O~1.PNG")) returned 1 [0031.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png")) returned 0x2020 [0031.266] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.266] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.267] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.268] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.269] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.270] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.270] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.270] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.270] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xfaf, lpOverlapped=0x0) returned 1 [0031.270] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xfaf, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xfaf, lpOverlapped=0x0) returned 1 [0031.270] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.270] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.270] CloseHandle (hObject=0x114) returned 1 [0031.271] CloseHandle (hObject=0xf8) returned 1 [0031.271] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png.crypt")) returned 0 [0031.272] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png.crypt")) returned 0x2020 [0031.272] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3faf, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEe4Oo[1].png", cAlternateFileName="BBEE4O~1.PNG")) returned 0x5c9000 [0031.272] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3faf, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEe4Oo[1].png", cAlternateFileName="BBEE4O~1.PNG")) returned 0 [0031.272] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.272] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png")) returned 1 [0031.273] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe4Oo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee4oo[1].png")) returned 0xffffffff [0031.273] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaa9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEe6Ew[1].jpg", cAlternateFileName="BBEE6E~1.JPG")) returned 1 [0031.273] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg")) returned 0x2020 [0031.274] VirtualAlloc (lpAddress=0x2e4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2e4000 [0031.274] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.274] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.275] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xaa9, lpOverlapped=0x0) returned 1 [0031.276] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xaa9, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xaa9, lpOverlapped=0x0) returned 1 [0031.277] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.277] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.277] CloseHandle (hObject=0xf8) returned 1 [0031.277] CloseHandle (hObject=0x114) returned 1 [0031.278] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg.crypt")) returned 0 [0031.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg.crypt")) returned 0x2020 [0031.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaa9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEe6Ew[1].jpg", cAlternateFileName="BBEE6E~1.JPG")) returned 0x5c9000 [0031.278] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaa9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEe6Ew[1].jpg", cAlternateFileName="BBEE6E~1.JPG")) returned 0 [0031.278] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.278] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg")) returned 1 [0031.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEe6Ew[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbee6ew[1].jpg")) returned 0xffffffff [0031.279] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d26, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeFp3[1].jpg", cAlternateFileName="BBEEFP~1.JPG")) returned 1 [0031.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg")) returned 0x2020 [0031.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.280] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.282] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.282] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xd26, lpOverlapped=0x0) returned 1 [0031.283] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xd26, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xd26, lpOverlapped=0x0) returned 1 [0031.283] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.283] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.283] CloseHandle (hObject=0x114) returned 1 [0031.283] CloseHandle (hObject=0xf8) returned 1 [0031.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg.crypt")) returned 0 [0031.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg.crypt")) returned 0x2020 [0031.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d26, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeFp3[1].jpg", cAlternateFileName="BBEEFP~1.JPG")) returned 0x5c9000 [0031.284] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454c4930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1d26, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeFp3[1].jpg", cAlternateFileName="BBEEFP~1.JPG")) returned 0 [0031.284] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.284] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg")) returned 1 [0031.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeFp3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeefp3[1].jpg")) returned 0xffffffff [0031.285] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe3bfdf0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe3bfdf0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe3bfdf0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeGwU[1].jpg", cAlternateFileName="BBEEGW~1.JPG")) returned 1 [0031.285] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg")) returned 0x2020 [0031.286] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.286] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.286] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x780, lpOverlapped=0x0) returned 1 [0031.288] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x780, lpOverlapped=0x0) returned 1 [0031.289] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.289] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.289] CloseHandle (hObject=0xf8) returned 1 [0031.289] CloseHandle (hObject=0x114) returned 1 [0031.289] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg.crypt")) returned 0 [0031.290] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg.crypt")) returned 0x2020 [0031.290] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe3bfdf0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe3bfdf0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe3bfdf0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeGwU[1].jpg", cAlternateFileName="BBEEGW~1.JPG")) returned 0x5c9000 [0031.290] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe3bfdf0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe3bfdf0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe3bfdf0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeGwU[1].jpg", cAlternateFileName="BBEEGW~1.JPG")) returned 0 [0031.290] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.290] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg")) returned 1 [0031.291] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeGwU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeegwu[1].jpg")) returned 0xffffffff [0031.291] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7be, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeUg0[1].jpg", cAlternateFileName="BBEEUG~1.JPG")) returned 1 [0031.291] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg")) returned 0x2020 [0031.291] VirtualAlloc (lpAddress=0x2e8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2e8000 [0031.291] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.294] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7be, lpOverlapped=0x0) returned 1 [0031.295] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7be, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7be, lpOverlapped=0x0) returned 1 [0031.296] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.296] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.296] CloseHandle (hObject=0x114) returned 1 [0031.296] CloseHandle (hObject=0xf8) returned 1 [0031.297] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg.crypt")) returned 0 [0031.297] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg.crypt")) returned 0x2020 [0031.297] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7be, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeUg0[1].jpg", cAlternateFileName="BBEEUG~1.JPG")) returned 0x5c9000 [0031.297] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b505b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b505b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b505b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7be, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeUg0[1].jpg", cAlternateFileName="BBEEUG~1.JPG")) returned 0 [0031.297] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.298] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg")) returned 1 [0031.298] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeUg0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeug0[1].jpg")) returned 0xffffffff [0031.298] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2a, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeZnr[1].jpg", cAlternateFileName="BBEEZN~1.JPG")) returned 1 [0031.300] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg")) returned 0x2020 [0031.300] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.301] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.301] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.303] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.304] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.304] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.304] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.304] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.304] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xa2a, lpOverlapped=0x0) returned 1 [0031.304] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xa2a, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xa2a, lpOverlapped=0x0) returned 1 [0031.304] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.305] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.305] CloseHandle (hObject=0xf8) returned 1 [0031.305] CloseHandle (hObject=0x114) returned 1 [0031.305] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg.crypt")) returned 0 [0031.306] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg.crypt")) returned 0x2020 [0031.306] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeZnr[1].jpg", cAlternateFileName="BBEEZN~1.JPG")) returned 0x5c9000 [0031.306] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3a2a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeZnr[1].jpg", cAlternateFileName="BBEEZN~1.JPG")) returned 0 [0031.306] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.306] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg")) returned 1 [0031.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEeZnr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeeznr[1].jpg")) returned 0xffffffff [0031.307] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEf5Lq[1].jpg", cAlternateFileName="BBEF5L~1.JPG")) returned 1 [0031.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg")) returned 0x2020 [0031.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.308] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.309] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.310] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.311] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.311] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xf76, lpOverlapped=0x0) returned 1 [0031.311] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xf76, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xf76, lpOverlapped=0x0) returned 1 [0031.311] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.311] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.311] CloseHandle (hObject=0x114) returned 1 [0031.311] CloseHandle (hObject=0xf8) returned 1 [0031.312] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg.crypt")) returned 0 [0031.312] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg.crypt")) returned 0x2020 [0031.312] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEf5Lq[1].jpg", cAlternateFileName="BBEF5L~1.JPG")) returned 0x5c9000 [0031.312] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEf5Lq[1].jpg", cAlternateFileName="BBEF5L~1.JPG")) returned 0 [0031.313] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.313] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg")) returned 1 [0031.314] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEf5Lq[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbef5lq[1].jpg")) returned 0xffffffff [0031.314] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 1 [0031.314] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg")) returned 0x2020 [0031.314] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.314] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.315] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x786, lpOverlapped=0x0) returned 1 [0031.316] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x786, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x786, lpOverlapped=0x0) returned 1 [0031.317] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.317] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.317] CloseHandle (hObject=0xf8) returned 1 [0031.317] CloseHandle (hObject=0x114) returned 1 [0031.318] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg.crypt")) returned 0 [0031.319] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg.crypt")) returned 0x2020 [0031.319] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 0x5c9000 [0031.319] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 0 [0031.319] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.319] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg")) returned 1 [0031.320] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefwtu[1].jpg")) returned 0xffffffff [0031.320] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfzSd[1].jpg", cAlternateFileName="BBEFZS~1.JPG")) returned 1 [0031.320] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg")) returned 0x2020 [0031.321] VirtualAlloc (lpAddress=0x2ec000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2ec000 [0031.321] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.321] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.321] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xa07, lpOverlapped=0x0) returned 1 [0031.323] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xa07, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xa07, lpOverlapped=0x0) returned 1 [0031.324] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.324] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.324] CloseHandle (hObject=0x114) returned 1 [0031.324] CloseHandle (hObject=0xf8) returned 1 [0031.325] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg.crypt")) returned 0 [0031.325] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg.crypt")) returned 0x2020 [0031.325] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfzSd[1].jpg", cAlternateFileName="BBEFZS~1.JPG")) returned 0x5c9000 [0031.325] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfzSd[1].jpg", cAlternateFileName="BBEFZS~1.JPG")) returned 0 [0031.325] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.325] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg")) returned 1 [0031.326] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEfzSd[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbefzsd[1].jpg")) returned 0xffffffff [0031.326] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgCuQ[1].jpg", cAlternateFileName="BBEGCU~1.JPG")) returned 1 [0031.326] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg")) returned 0x2020 [0031.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.329] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.331] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.332] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x998, lpOverlapped=0x0) returned 1 [0031.332] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x998, lpOverlapped=0x0) returned 1 [0031.332] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.332] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.333] CloseHandle (hObject=0xf8) returned 1 [0031.333] CloseHandle (hObject=0x114) returned 1 [0031.334] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg.crypt")) returned 0 [0031.334] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg.crypt")) returned 0x2020 [0031.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgCuQ[1].jpg", cAlternateFileName="BBEGCU~1.JPG")) returned 0x5c9000 [0031.334] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgCuQ[1].jpg", cAlternateFileName="BBEGCU~1.JPG")) returned 0 [0031.334] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.334] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg")) returned 1 [0031.335] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgCuQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegcuq[1].jpg")) returned 0xffffffff [0031.335] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a65, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgHzB[1].jpg", cAlternateFileName="BBEGHZ~1.JPG")) returned 1 [0031.335] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg")) returned 0x2020 [0031.335] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.336] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.336] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.338] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.339] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xa65, lpOverlapped=0x0) returned 1 [0031.339] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xa65, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xa65, lpOverlapped=0x0) returned 1 [0031.339] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.339] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.339] CloseHandle (hObject=0x114) returned 1 [0031.339] CloseHandle (hObject=0xf8) returned 1 [0031.340] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg.crypt")) returned 0 [0031.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg.crypt")) returned 0x2020 [0031.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a65, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgHzB[1].jpg", cAlternateFileName="BBEGHZ~1.JPG")) returned 0x5c9000 [0031.340] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454c4930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454c4930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1a65, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgHzB[1].jpg", cAlternateFileName="BBEGHZ~1.JPG")) returned 0 [0031.341] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.341] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg")) returned 1 [0031.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgHzB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeghzb[1].jpg")) returned 0xffffffff [0031.342] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdeb0f30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5a45, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgIl2[1].jpg", cAlternateFileName="BBEGIL~1.JPG")) returned 1 [0031.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg")) returned 0x2020 [0031.342] VirtualAlloc (lpAddress=0x2f0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2f0000 [0031.342] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.342] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.343] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.345] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.345] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.346] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.346] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.346] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.346] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.346] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.346] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.347] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.347] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xa45, lpOverlapped=0x0) returned 1 [0031.347] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xa45, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xa45, lpOverlapped=0x0) returned 1 [0031.347] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.347] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.347] CloseHandle (hObject=0xf8) returned 1 [0031.347] CloseHandle (hObject=0x114) returned 1 [0031.348] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg.crypt")) returned 0 [0031.348] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg.crypt")) returned 0x2020 [0031.348] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdeb0f30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5a45, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgIl2[1].jpg", cAlternateFileName="BBEGIL~1.JPG")) returned 0x5c9000 [0031.349] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde8add0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde8add0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdeb0f30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5a45, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgIl2[1].jpg", cAlternateFileName="BBEGIL~1.JPG")) returned 0 [0031.349] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.349] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg")) returned 1 [0031.350] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[1].jpg")) returned 0xffffffff [0031.350] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x388f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgIl2[2].jpg", cAlternateFileName="BBEGIL~2.JPG")) returned 1 [0031.350] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg")) returned 0x2020 [0031.351] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.351] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.351] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.353] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.354] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.354] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.354] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.354] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.355] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x88f, lpOverlapped=0x0) returned 1 [0031.355] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x88f, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x88f, lpOverlapped=0x0) returned 1 [0031.355] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.355] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.355] CloseHandle (hObject=0x114) returned 1 [0031.355] CloseHandle (hObject=0xf8) returned 1 [0031.356] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg.crypt")) returned 0 [0031.356] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg.crypt")) returned 0x2020 [0031.356] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x388f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgIl2[2].jpg", cAlternateFileName="BBEGIL~2.JPG")) returned 0x5c9000 [0031.356] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x388f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgIl2[2].jpg", cAlternateFileName="BBEGIL~2.JPG")) returned 0 [0031.356] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.356] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg")) returned 1 [0031.357] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIl2[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegil2[2].jpg")) returned 0xffffffff [0031.357] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1e97, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgIyL[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 1 [0031.358] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg")) returned 0x2020 [0031.359] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.359] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.360] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.361] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.362] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xe97, lpOverlapped=0x0) returned 1 [0031.362] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xe97, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xe97, lpOverlapped=0x0) returned 1 [0031.363] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.363] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.363] CloseHandle (hObject=0xf8) returned 1 [0031.363] CloseHandle (hObject=0x114) returned 1 [0031.364] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg.crypt")) returned 0 [0031.364] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg.crypt")) returned 0x2020 [0031.364] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1e97, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgIyL[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 0x5c9000 [0031.364] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1e97, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgIyL[1].jpg", cAlternateFileName="BBEGIY~1.JPG")) returned 0 [0031.364] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.364] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg")) returned 1 [0031.365] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgIyL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegiyl[1].jpg")) returned 0xffffffff [0031.365] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23bf, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgkY6[1].jpg", cAlternateFileName="BBEGKY~1.JPG")) returned 1 [0031.365] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg")) returned 0x2020 [0031.365] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.366] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.366] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.368] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.368] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.369] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.369] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x3bf, lpOverlapped=0x0) returned 1 [0031.369] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x3bf, lpOverlapped=0x0) returned 1 [0031.369] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.369] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.369] CloseHandle (hObject=0x114) returned 1 [0031.369] CloseHandle (hObject=0xf8) returned 1 [0031.370] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg.crypt")) returned 0 [0031.370] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg.crypt")) returned 0x2020 [0031.370] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23bf, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgkY6[1].jpg", cAlternateFileName="BBEGKY~1.JPG")) returned 0x5c9000 [0031.370] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23bf, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgkY6[1].jpg", cAlternateFileName="BBEGKY~1.JPG")) returned 0 [0031.370] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.371] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg")) returned 1 [0031.371] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgkY6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegky6[1].jpg")) returned 0xffffffff [0031.372] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8df, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgLzV[1].jpg", cAlternateFileName="BBEGLZ~1.JPG")) returned 1 [0031.372] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg")) returned 0x2020 [0031.372] VirtualAlloc (lpAddress=0x2f4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2f4000 [0031.372] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.372] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.373] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x8df, lpOverlapped=0x0) returned 1 [0031.374] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x8df, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x8df, lpOverlapped=0x0) returned 1 [0031.375] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.375] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.375] CloseHandle (hObject=0xf8) returned 1 [0031.375] CloseHandle (hObject=0x114) returned 1 [0031.376] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg.crypt")) returned 0 [0031.376] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg.crypt")) returned 0x2020 [0031.376] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8df, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgLzV[1].jpg", cAlternateFileName="BBEGLZ~1.JPG")) returned 0x5c9000 [0031.376] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8df, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgLzV[1].jpg", cAlternateFileName="BBEGLZ~1.JPG")) returned 0 [0031.376] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.376] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg")) returned 1 [0031.377] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgLzV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeglzv[1].jpg")) returned 0xffffffff [0031.377] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8d, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgUri[1].jpg", cAlternateFileName="BBEGUR~1.JPG")) returned 1 [0031.377] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg")) returned 0x2020 [0031.378] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.378] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.378] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.380] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.381] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.382] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.382] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xb8d, lpOverlapped=0x0) returned 1 [0031.382] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xb8d, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xb8d, lpOverlapped=0x0) returned 1 [0031.382] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.382] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.382] CloseHandle (hObject=0x114) returned 1 [0031.382] CloseHandle (hObject=0xf8) returned 1 [0031.383] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg.crypt")) returned 0 [0031.383] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg.crypt")) returned 0x2020 [0031.383] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgUri[1].jpg", cAlternateFileName="BBEGUR~1.JPG")) returned 0x5c9000 [0031.383] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgUri[1].jpg", cAlternateFileName="BBEGUR~1.JPG")) returned 0 [0031.384] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.384] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg")) returned 1 [0031.385] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgUri[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbeguri[1].jpg")) returned 0xffffffff [0031.385] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgXBv[1].jpg", cAlternateFileName="BBEGXB~1.JPG")) returned 1 [0031.385] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg")) returned 0x2020 [0031.385] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.385] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.385] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.387] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.388] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.388] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.389] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1f, lpOverlapped=0x0) returned 1 [0031.389] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1f, lpOverlapped=0x0) returned 1 [0031.389] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.389] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.389] CloseHandle (hObject=0xf8) returned 1 [0031.389] CloseHandle (hObject=0x114) returned 1 [0031.390] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg.crypt")) returned 0 [0031.390] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg.crypt")) returned 0x2020 [0031.390] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgXBv[1].jpg", cAlternateFileName="BBEGXB~1.JPG")) returned 0x5c9000 [0031.390] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457721f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457721f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgXBv[1].jpg", cAlternateFileName="BBEGXB~1.JPG")) returned 0 [0031.390] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.390] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg")) returned 1 [0031.391] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgXBv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegxbv[1].jpg")) returned 0xffffffff [0031.391] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgZME[1].jpg", cAlternateFileName="BBEGZM~1.JPG")) returned 1 [0031.391] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg")) returned 0x2020 [0031.392] VirtualAlloc (lpAddress=0x2f8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2f8000 [0031.393] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.393] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.393] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x6e9, lpOverlapped=0x0) returned 1 [0031.394] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x6e9, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x6e9, lpOverlapped=0x0) returned 1 [0031.395] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.395] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.395] CloseHandle (hObject=0x114) returned 1 [0031.395] CloseHandle (hObject=0xf8) returned 1 [0031.396] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg.crypt")) returned 0 [0031.397] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg.crypt")) returned 0x2020 [0031.397] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgZME[1].jpg", cAlternateFileName="BBEGZM~1.JPG")) returned 0x5c9000 [0031.397] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe327870, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe327870, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgZME[1].jpg", cAlternateFileName="BBEGZM~1.JPG")) returned 0 [0031.397] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.397] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg")) returned 1 [0031.398] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBEgZME[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbegzme[1].jpg")) returned 0xffffffff [0031.398] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBghfVy[1].png", cAlternateFileName="BBGHFV~1.PNG")) returned 1 [0031.398] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png")) returned 0x2020 [0031.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.399] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1dc, lpOverlapped=0x0) returned 1 [0031.400] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1dc, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1dc, lpOverlapped=0x0) returned 1 [0031.401] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.401] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.401] CloseHandle (hObject=0xf8) returned 1 [0031.401] CloseHandle (hObject=0x114) returned 1 [0031.402] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png.crypt")) returned 0 [0031.402] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png.crypt")) returned 0x2020 [0031.402] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBghfVy[1].png", cAlternateFileName="BBGHFV~1.PNG")) returned 0x5c9000 [0031.402] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBghfVy[1].png", cAlternateFileName="BBGHFV~1.PNG")) returned 0 [0031.402] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.402] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png")) returned 1 [0031.403] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBghfVy[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbghfvy[1].png")) returned 0xffffffff [0031.403] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBkwUr[1].png", cAlternateFileName="BBKWUR~1.PNG")) returned 1 [0031.403] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png")) returned 0x2020 [0031.403] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.403] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.404] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1af, lpOverlapped=0x0) returned 1 [0031.405] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1af, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1af, lpOverlapped=0x0) returned 1 [0031.406] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.406] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.406] CloseHandle (hObject=0x114) returned 1 [0031.406] CloseHandle (hObject=0xf8) returned 1 [0031.407] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png.crypt")) returned 0 [0031.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png.crypt")) returned 0x2020 [0031.407] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="BBkwUr[1].png", cAlternateFileName="BBKWUR~1.PNG")) returned 0x5c9000 [0031.407] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="BBkwUr[1].png", cAlternateFileName="BBKWUR~1.PNG")) returned 0 [0031.407] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.407] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png")) returned 1 [0031.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBkwUr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbkwur[1].png")) returned 0xffffffff [0031.408] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBlBV0U[1].png", cAlternateFileName="BBLBV0~1.PNG")) returned 1 [0031.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png")) returned 0x2020 [0031.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.409] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.409] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x23b, lpOverlapped=0x0) returned 1 [0031.410] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x23b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x23b, lpOverlapped=0x0) returned 1 [0031.411] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.411] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.411] CloseHandle (hObject=0xf8) returned 1 [0031.411] CloseHandle (hObject=0x114) returned 1 [0031.412] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png.crypt")) returned 0 [0031.412] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png.crypt")) returned 0x2020 [0031.413] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBlBV0U[1].png", cAlternateFileName="BBLBV0~1.PNG")) returned 0x5c9000 [0031.413] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBlBV0U[1].png", cAlternateFileName="BBLBV0~1.PNG")) returned 0 [0031.413] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.413] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png")) returned 1 [0031.414] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBlBV0U[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bblbv0u[1].png")) returned 0xffffffff [0031.414] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3376, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBzhWWE[1].jpg", cAlternateFileName="BBZHWW~1.JPG")) returned 1 [0031.414] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg")) returned 0x2020 [0031.414] VirtualAlloc (lpAddress=0x2fc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2fc000 [0031.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.415] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.417] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.418] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.418] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.418] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.418] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.418] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x376, lpOverlapped=0x0) returned 1 [0031.419] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x376, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x376, lpOverlapped=0x0) returned 1 [0031.419] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.419] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.419] CloseHandle (hObject=0x114) returned 1 [0031.419] CloseHandle (hObject=0xf8) returned 1 [0031.420] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg.crypt")) returned 0 [0031.420] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg.crypt")) returned 0x2020 [0031.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3376, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBzhWWE[1].jpg", cAlternateFileName="BBZHWW~1.JPG")) returned 0x5c9000 [0031.420] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3376, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBzhWWE[1].jpg", cAlternateFileName="BBZHWW~1.JPG")) returned 0 [0031.420] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.420] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg")) returned 1 [0031.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBzhWWE[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbzhwwe[1].jpg")) returned 0xffffffff [0031.421] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60baae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60baae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c433c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13c06, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="benefits-2[1].jpg", cAlternateFileName="BENEFI~2.JPG")) returned 1 [0031.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg")) returned 0x2020 [0031.427] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.427] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.427] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.431] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.432] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.432] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.432] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.432] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.432] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.432] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.433] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.433] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.433] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.433] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.433] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.433] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.434] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.434] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.434] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.434] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.434] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.434] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.434] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.435] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.435] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.435] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.435] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.435] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.435] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.435] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.436] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.436] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.436] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.436] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.436] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.436] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.437] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.437] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.437] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.437] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.437] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xc06, lpOverlapped=0x0) returned 1 [0031.437] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xc06, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xc06, lpOverlapped=0x0) returned 1 [0031.437] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.437] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.438] CloseHandle (hObject=0xf8) returned 1 [0031.438] CloseHandle (hObject=0x114) returned 1 [0031.439] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg.crypt")) returned 0 [0031.439] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg.crypt")) returned 0x2020 [0031.439] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60baae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60baae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c433c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13c06, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="benefits-2[1].jpg", cAlternateFileName="BENEFI~2.JPG")) returned 0x5c9000 [0031.440] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60baae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60baae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c433c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13c06, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="benefits-2[1].jpg", cAlternateFileName="BENEFI~2.JPG")) returned 0 [0031.440] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.440] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg")) returned 1 [0031.441] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-2[1].jpg")) returned 0xffffffff [0031.441] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b84ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b84ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c1d260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144cd, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="benefits-4[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 1 [0031.441] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg")) returned 0x2020 [0031.441] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.442] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.442] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.444] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.445] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.446] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.446] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.446] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.446] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.446] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.446] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.447] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.447] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.447] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.447] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.447] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.447] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.447] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.448] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.448] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.448] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.448] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.448] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.449] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.449] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.449] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.449] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.449] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.449] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.449] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.450] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.450] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.450] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.450] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.450] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.450] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.451] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.451] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.451] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.451] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.451] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.451] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.451] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x4cd, lpOverlapped=0x0) returned 1 [0031.452] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x4cd, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x4cd, lpOverlapped=0x0) returned 1 [0031.452] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.452] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.452] CloseHandle (hObject=0x114) returned 1 [0031.452] CloseHandle (hObject=0xf8) returned 1 [0031.453] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg.crypt")) returned 0 [0031.453] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg.crypt")) returned 0x2020 [0031.454] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b84ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b84ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c1d260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144cd, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="benefits-4[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 0x5c9000 [0031.454] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b84ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b84ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c1d260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144cd, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="benefits-4[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 0 [0031.454] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.454] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg")) returned 1 [0031.455] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\benefits-4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\benefits-4[1].jpg")) returned 0xffffffff [0031.455] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4dbc10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4dbc10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4dbc10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6f15, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="bootstrap[1].js", cAlternateFileName="BOOTST~1.JS")) returned 1 [0031.455] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x583e0320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x583e0320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x583e0320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf6, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="browser[1].htm", cAlternateFileName="BROWSE~1.HTM")) returned 1 [0031.455] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b2b1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b2b1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b2b1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4dd8, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="bs-jsdep[1].css", cAlternateFileName="BS-JSD~1.CSS")) returned 1 [0031.455] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61341460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61341460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x613675c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c9f6, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0031.455] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1 [0031.455] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29349, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="core[1].css", cAlternateFileName="CORE_1~1.CSS")) returned 1 [0031.455] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0031.455] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini")) returned 0x2006 [0031.456] VirtualAlloc (lpAddress=0x300000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x300000 [0031.456] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.456] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.456] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x43, lpOverlapped=0x0) returned 1 [0031.457] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x43, lpOverlapped=0x0) returned 1 [0031.461] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.461] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.461] CloseHandle (hObject=0xf8) returned 1 [0031.461] CloseHandle (hObject=0x114) returned 1 [0031.461] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini.crypt")) returned 0 [0031.461] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini.crypt")) returned 0x2020 [0031.461] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0031.461] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0031.462] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.462] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini")) returned 1 [0031.462] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\desktop.ini")) returned 0xffffffff [0031.463] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54ca7f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ca7f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54ca7f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a3c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="DevCMDL2.2.18[1].eot", cAlternateFileName="DEVCMD~1.EOT")) returned 1 [0031.463] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5120a1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5120a1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5120a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="e151e5[1].gif", cAlternateFileName="E151E5~1.GIF")) returned 1 [0031.463] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5101afd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5101afd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5101afd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24e29, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="e4-190963-91cdfbc1[1].txt", cAlternateFileName="E4-190~1.TXT")) returned 1 [0031.463] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt")) returned 0x2020 [0031.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.463] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.466] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.467] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.467] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.468] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.468] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.468] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.468] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.468] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.468] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.469] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.469] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.469] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.469] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.469] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.469] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.469] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.470] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.470] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.470] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.470] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.470] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.470] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.471] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.471] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.471] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.471] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.471] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.471] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.471] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.472] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.472] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.472] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.472] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.472] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.472] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.473] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.473] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.473] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.473] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.473] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.473] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.473] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.474] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.474] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.474] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.474] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.474] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.474] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.475] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.475] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.475] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.475] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.475] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.475] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.475] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.476] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.476] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.476] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.476] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.476] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.476] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.477] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.477] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.477] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.477] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.477] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.477] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.477] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.478] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.478] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.478] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.478] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xe29, lpOverlapped=0x0) returned 1 [0031.478] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xe29, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xe29, lpOverlapped=0x0) returned 1 [0031.478] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.478] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.478] CloseHandle (hObject=0x114) returned 1 [0031.478] CloseHandle (hObject=0xf8) returned 1 [0031.481] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt.crypt")) returned 0 [0031.481] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt.crypt")) returned 0x2020 [0031.481] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5101afd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5101afd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5101afd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24e29, dwReserved0=0x5d6fc8, dwReserved1=0x18e59c, cFileName="e4-190963-91cdfbc1[1].txt", cAlternateFileName="E4-190~1.TXT")) returned 0x5c9000 [0031.481] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5101afd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5101afd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5101afd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24e29, dwReserved0=0x5d6fc8, dwReserved1=0x18e59c, cFileName="e4-190963-91cdfbc1[1].txt", cAlternateFileName="E4-190~1.TXT")) returned 0 [0031.481] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.481] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt")) returned 1 [0031.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\e4-190963-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\e4-190963-91cdfbc1[1].txt")) returned 0xffffffff [0031.483] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b5eb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b5eb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f89200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8f5, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="eula_text[1].htm", cAlternateFileName="EULA_T~1.HTM")) returned 1 [0031.483] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="f[1].txt", cAlternateFileName="F_1_~1.TXT")) returned 1 [0031.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt")) returned 0x2020 [0031.484] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.484] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.485] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.489] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.490] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.490] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.491] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.491] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.491] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x4ce, lpOverlapped=0x0) returned 1 [0031.491] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x4ce, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x4ce, lpOverlapped=0x0) returned 1 [0031.491] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.491] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.491] CloseHandle (hObject=0xf8) returned 1 [0031.491] CloseHandle (hObject=0x114) returned 1 [0031.492] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt.crypt")) returned 0 [0031.492] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt.crypt")) returned 0x2020 [0031.492] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0x5d6fa8, dwReserved1=0x18e59c, cFileName="f[1].txt", cAlternateFileName="F_1_~1.TXT")) returned 0x5c9000 [0031.492] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62410fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62410fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x62410fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0x5d6fa8, dwReserved1=0x18e59c, cFileName="f[1].txt", cAlternateFileName="F_1_~1.TXT")) returned 0 [0031.493] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.493] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt")) returned 1 [0031.494] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\f[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\f[1].txt")) returned 0xffffffff [0031.494] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1254, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0031.494] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ef0c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ef0c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f16de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="google_plus_16dp[1].png", cAlternateFileName="GOOGLE~1.PNG")) returned 1 [0031.494] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png")) returned 0x2020 [0031.494] VirtualAlloc (lpAddress=0x304000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x304000 [0031.494] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.494] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.495] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x6a6, lpOverlapped=0x0) returned 1 [0031.496] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x6a6, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x6a6, lpOverlapped=0x0) returned 1 [0031.497] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.497] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.497] CloseHandle (hObject=0x114) returned 1 [0031.497] CloseHandle (hObject=0xf8) returned 1 [0031.498] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png.crypt")) returned 0 [0031.498] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png.crypt")) returned 0x2020 [0031.498] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ef0c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ef0c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f16de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x5d6fc8, dwReserved1=0x18e59c, cFileName="google_plus_16dp[1].png", cAlternateFileName="GOOGLE~1.PNG")) returned 0x5c9000 [0031.498] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60ef0c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60ef0c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f16de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x5d6fc8, dwReserved1=0x18e59c, cFileName="google_plus_16dp[1].png", cAlternateFileName="GOOGLE~1.PNG")) returned 0 [0031.499] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.499] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png")) returned 1 [0031.499] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\google_plus_16dp[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\google_plus_16dp[1].png")) returned 0xffffffff [0031.500] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de2e5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5de2e5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5de54720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6c8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index[1].htm", cAlternateFileName="INDEX_~1.HTM")) returned 1 [0031.500] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa1af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54fa1af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54fa1af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="print[1].txt", cAlternateFileName="PRINT_~1.TXT")) returned 1 [0031.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt")) returned 0x2020 [0031.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.500] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xa2, lpOverlapped=0x0) returned 1 [0031.502] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xa2, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xa2, lpOverlapped=0x0) returned 1 [0031.502] ReadFile (in: hFile=0xf8, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.502] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.503] CloseHandle (hObject=0xf8) returned 1 [0031.503] CloseHandle (hObject=0x114) returned 1 [0031.503] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt.crypt")) returned 0 [0031.503] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt.crypt")) returned 0x2020 [0031.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa1af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54fa1af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54fa1af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="print[1].txt", cAlternateFileName="PRINT_~1.TXT")) returned 0x5c9000 [0031.504] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa1af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54fa1af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54fa1af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="print[1].txt", cAlternateFileName="PRINT_~1.TXT")) returned 0 [0031.504] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.504] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt")) returned 1 [0031.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\print[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\print[1].txt")) returned 0xffffffff [0031.505] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44f697b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44f697b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44f8f910, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x15429, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="Standard[1]", cAlternateFileName="STANDA~1")) returned 1 [0031.505] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 1 [0031.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png")) returned 0x2020 [0031.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.506] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x67, lpOverlapped=0x0) returned 1 [0031.507] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x67, lpOverlapped=0x0) returned 1 [0031.508] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.508] WriteFile (in: hFile=0xf8, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.508] CloseHandle (hObject=0x114) returned 1 [0031.508] CloseHandle (hObject=0xf8) returned 1 [0031.509] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png.crypt")) returned 0 [0031.509] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png.crypt")) returned 0x2020 [0031.509] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 0x5c9000 [0031.509] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 0 [0031.509] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.509] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png")) returned 1 [0031.510] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\tecjslog[1].png")) returned 0xffffffff [0031.510] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x548efd10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x548efd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x548efd10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102ea, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="uhf-main.var.min[1].js", cAlternateFileName="UHF-MA~1.JS")) returned 1 [0031.510] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2dd5, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1 [0031.510] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d29, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="v2[2]", cAlternateFileName="V2_2_~1")) returned 1 [0031.510] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe751ef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe751ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe751ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2fa8, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="v2[3]", cAlternateFileName="V2_3_~1")) returned 1 [0031.511] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8829f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8829f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8829f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="v2[4]", cAlternateFileName="V2_4_~1")) returned 1 [0031.511] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8829f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8829f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8829f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="v2[4]", cAlternateFileName="V2_4_~1")) returned 0 [0031.511] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0031.511] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x696d2e72, dwReserved1=0x5d315b6e, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0031.511] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini")) returned 0x2006 [0031.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0031.513] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0031.513] WriteFile (in: hFile=0xf8, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0031.514] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0031.514] WriteFile (in: hFile=0xf8, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0031.514] CloseHandle (hObject=0x100) returned 1 [0031.514] CloseHandle (hObject=0xf8) returned 1 [0031.515] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini.crypt")) returned 0 [0031.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini.crypt")) returned 0x2020 [0031.515] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cdf78, dwReserved1=0x18e804, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8fc0 [0031.515] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5cdf78, dwReserved1=0x18e804, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0031.515] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0031.515] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini")) returned 1 [0031.516] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\desktop.ini")) returned 0xffffffff [0031.516] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5cde70, dwReserved1=0x18e79c, cFileName="IKQEEPZR", cAlternateFileName="")) returned 1 [0031.516] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0031.518] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0031.519] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45027e90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45027e90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45027e90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa756, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="19619569[1].gif", cAlternateFileName="196195~1.GIF")) returned 1 [0031.519] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54962130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54962130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x549ae3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x461fe, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="7962161087[1].js", cAlternateFileName="796216~1.JS")) returned 1 [0031.519] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="AA3DGHW[1].png", cAlternateFileName="AA3DGH~1.PNG")) returned 1 [0031.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png")) returned 0x2020 [0031.520] VirtualAlloc (lpAddress=0x308000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x308000 [0031.520] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.520] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.521] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x14d, lpOverlapped=0x0) returned 1 [0031.522] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x14d, lpOverlapped=0x0) returned 1 [0031.523] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.523] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.523] CloseHandle (hObject=0x100) returned 1 [0031.523] CloseHandle (hObject=0x114) returned 1 [0031.524] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png.crypt")) returned 0 [0031.524] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png.crypt")) returned 0x2020 [0031.524] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA3DGHW[1].png", cAlternateFileName="AA3DGH~1.PNG")) returned 0x5c9000 [0031.524] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA3DGHW[1].png", cAlternateFileName="AA3DGH~1.PNG")) returned 0 [0031.524] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.524] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png")) returned 1 [0031.525] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3DGHW[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3dghw[1].png")) returned 0xffffffff [0031.525] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA3e1pt[2].png", cAlternateFileName="AA3E1P~2.PNG")) returned 1 [0031.525] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png")) returned 0x2020 [0031.526] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.526] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.526] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x197, lpOverlapped=0x0) returned 1 [0031.528] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x197, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x197, lpOverlapped=0x0) returned 1 [0031.529] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.529] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.529] CloseHandle (hObject=0x114) returned 1 [0031.529] CloseHandle (hObject=0x100) returned 1 [0031.529] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png.crypt")) returned 0 [0031.530] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png.crypt")) returned 0x2020 [0031.530] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA3e1pt[2].png", cAlternateFileName="AA3E1P~2.PNG")) returned 0x5c9000 [0031.530] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA3e1pt[2].png", cAlternateFileName="AA3E1P~2.PNG")) returned 0 [0031.530] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.530] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png")) returned 1 [0031.531] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA3e1pt[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa3e1pt[2].png")) returned 0xffffffff [0031.531] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA42ckd[1].png", cAlternateFileName="AA42CK~1.PNG")) returned 1 [0031.531] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png")) returned 0x2020 [0031.531] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.531] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.531] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2c2, lpOverlapped=0x0) returned 1 [0031.533] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2c2, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2c2, lpOverlapped=0x0) returned 1 [0031.534] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.534] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.534] CloseHandle (hObject=0x100) returned 1 [0031.534] CloseHandle (hObject=0x114) returned 1 [0031.534] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png.crypt")) returned 0 [0031.535] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png.crypt")) returned 0x2020 [0031.535] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA42ckd[1].png", cAlternateFileName="AA42CK~1.PNG")) returned 0x5c9000 [0031.535] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA42ckd[1].png", cAlternateFileName="AA42CK~1.PNG")) returned 0 [0031.535] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.535] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png")) returned 1 [0031.536] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42ckd[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42ckd[1].png")) returned 0xffffffff [0031.536] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA42eYr[1].png", cAlternateFileName="AA42EY~1.PNG")) returned 1 [0031.536] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png")) returned 0x2020 [0031.536] VirtualAlloc (lpAddress=0x30c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x30c000 [0031.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.537] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2c2, lpOverlapped=0x0) returned 1 [0031.538] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2c2, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2c2, lpOverlapped=0x0) returned 1 [0031.539] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.539] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.539] CloseHandle (hObject=0x114) returned 1 [0031.539] CloseHandle (hObject=0x100) returned 1 [0031.539] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png.crypt")) returned 0 [0031.540] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png.crypt")) returned 0x2020 [0031.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA42eYr[1].png", cAlternateFileName="AA42EY~1.PNG")) returned 0x5c9000 [0031.540] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA42eYr[1].png", cAlternateFileName="AA42EY~1.PNG")) returned 0 [0031.540] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.540] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png")) returned 1 [0031.541] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA42eYr[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa42eyr[1].png")) returned 0xffffffff [0031.541] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA61ILp[2].png", cAlternateFileName="AA61IL~2.PNG")) returned 1 [0031.541] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png")) returned 0x2020 [0031.542] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.542] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.542] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x204, lpOverlapped=0x0) returned 1 [0031.544] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x204, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x204, lpOverlapped=0x0) returned 1 [0031.545] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.545] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.545] CloseHandle (hObject=0x100) returned 1 [0031.545] CloseHandle (hObject=0x114) returned 1 [0031.546] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png.crypt")) returned 0 [0031.546] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png.crypt")) returned 0x2020 [0031.546] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA61ILp[2].png", cAlternateFileName="AA61IL~2.PNG")) returned 0x5c9000 [0031.546] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA61ILp[2].png", cAlternateFileName="AA61IL~2.PNG")) returned 0 [0031.546] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.546] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png")) returned 1 [0031.547] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA61ILp[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa61ilp[2].png")) returned 0xffffffff [0031.547] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA6SNZ6[1].png", cAlternateFileName="AA6SNZ~1.PNG")) returned 1 [0031.547] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png")) returned 0x2020 [0031.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.548] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2ed, lpOverlapped=0x0) returned 1 [0031.549] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2ed, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2ed, lpOverlapped=0x0) returned 1 [0031.550] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.550] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.550] CloseHandle (hObject=0x114) returned 1 [0031.550] CloseHandle (hObject=0x100) returned 1 [0031.551] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png.crypt")) returned 0 [0031.551] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png.crypt")) returned 0x2020 [0031.551] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA6SNZ6[1].png", cAlternateFileName="AA6SNZ~1.PNG")) returned 0x5c9000 [0031.551] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA6SNZ6[1].png", cAlternateFileName="AA6SNZ~1.PNG")) returned 0 [0031.551] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.551] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png")) returned 1 [0031.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AA6SNZ6[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aa6snz6[1].png")) returned 0xffffffff [0031.552] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAbyinC[1].png", cAlternateFileName="AABYIN~1.PNG")) returned 1 [0031.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png")) returned 0x2020 [0031.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.555] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.555] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2fc, lpOverlapped=0x0) returned 1 [0031.556] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2fc, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2fc, lpOverlapped=0x0) returned 1 [0031.557] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.557] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.557] CloseHandle (hObject=0x100) returned 1 [0031.557] CloseHandle (hObject=0x114) returned 1 [0031.558] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png.crypt")) returned 0 [0031.558] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png.crypt")) returned 0x2020 [0031.558] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAbyinC[1].png", cAlternateFileName="AABYIN~1.PNG")) returned 0x5c9000 [0031.558] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x454eaa90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x454eaa90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x454eaa90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAbyinC[1].png", cAlternateFileName="AABYIN~1.PNG")) returned 0 [0031.558] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.559] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png")) returned 1 [0031.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAbyinC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aabyinc[1].png")) returned 0xffffffff [0031.559] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x340b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAicW5W[1].jpg", cAlternateFileName="AAICW5~1.JPG")) returned 1 [0031.560] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg")) returned 0x2020 [0031.560] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x1f20000 [0031.560] VirtualAlloc (lpAddress=0x1f20000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f20000 [0031.560] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.560] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.561] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.563] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.563] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.564] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.564] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.564] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.564] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x40b, lpOverlapped=0x0) returned 1 [0031.564] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x40b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x40b, lpOverlapped=0x0) returned 1 [0031.564] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.564] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.564] CloseHandle (hObject=0x114) returned 1 [0031.565] CloseHandle (hObject=0x100) returned 1 [0031.565] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg.crypt")) returned 0 [0031.565] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg.crypt")) returned 0x2020 [0031.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x340b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAicW5W[1].jpg", cAlternateFileName="AAICW5~1.JPG")) returned 0x5c9000 [0031.566] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x340b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAicW5W[1].jpg", cAlternateFileName="AAICW5~1.JPG")) returned 0 [0031.566] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.566] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg")) returned 1 [0031.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAicW5W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaicw5w[1].jpg")) returned 0xffffffff [0031.567] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538925d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538925d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAj0doQ[1].jpg", cAlternateFileName="AAJ0DO~1.JPG")) returned 1 [0031.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg")) returned 0x2020 [0031.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.568] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.569] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.570] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9a4, lpOverlapped=0x0) returned 1 [0031.571] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9a4, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9a4, lpOverlapped=0x0) returned 1 [0031.571] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.571] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.571] CloseHandle (hObject=0x100) returned 1 [0031.571] CloseHandle (hObject=0x114) returned 1 [0031.572] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg.crypt")) returned 0 [0031.572] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg.crypt")) returned 0x2020 [0031.572] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538925d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538925d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAj0doQ[1].jpg", cAlternateFileName="AAJ0DO~1.JPG")) returned 0x5c9000 [0031.572] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538925d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538925d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAj0doQ[1].jpg", cAlternateFileName="AAJ0DO~1.JPG")) returned 0 [0031.572] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.572] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg")) returned 1 [0031.573] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAj0doQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aaj0doq[1].jpg")) returned 0xffffffff [0031.573] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAkqhIf[1].png", cAlternateFileName="AAKQHI~1.PNG")) returned 1 [0031.573] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png")) returned 0x2020 [0031.573] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.574] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.574] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x35c, lpOverlapped=0x0) returned 1 [0031.576] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x35c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x35c, lpOverlapped=0x0) returned 1 [0031.577] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.577] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.577] CloseHandle (hObject=0x114) returned 1 [0031.577] CloseHandle (hObject=0x100) returned 1 [0031.578] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png.crypt")) returned 0 [0031.578] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png.crypt")) returned 0x2020 [0031.578] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAkqhIf[1].png", cAlternateFileName="AAKQHI~1.PNG")) returned 0x5c9000 [0031.579] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAkqhIf[1].png", cAlternateFileName="AAKQHI~1.PNG")) returned 0 [0031.579] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.579] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png")) returned 1 [0031.580] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAkqhIf[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aakqhif[1].png")) returned 0xffffffff [0031.580] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x278e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAmo09p[1].jpg", cAlternateFileName="AAMO09~1.JPG")) returned 1 [0031.580] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg")) returned 0x2020 [0031.580] VirtualAlloc (lpAddress=0x1f24000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f24000 [0031.580] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.580] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.581] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.584] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.585] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.585] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.585] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x78e, lpOverlapped=0x0) returned 1 [0031.585] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x78e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x78e, lpOverlapped=0x0) returned 1 [0031.585] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.585] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.585] CloseHandle (hObject=0x100) returned 1 [0031.585] CloseHandle (hObject=0x114) returned 1 [0031.586] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg.crypt")) returned 0 [0031.586] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg.crypt")) returned 0x2020 [0031.587] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x278e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAmo09p[1].jpg", cAlternateFileName="AAMO09~1.JPG")) returned 0x5c9000 [0031.587] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x278e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAmo09p[1].jpg", cAlternateFileName="AAMO09~1.JPG")) returned 0 [0031.587] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.587] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg")) returned 1 [0031.588] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmo09p[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamo09p[1].jpg")) returned 0xffffffff [0031.588] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAmUyV2[1].png", cAlternateFileName="AAMUYV~1.PNG")) returned 1 [0031.588] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png")) returned 0x2020 [0031.588] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.588] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.588] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x19a, lpOverlapped=0x0) returned 1 [0031.590] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x19a, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x19a, lpOverlapped=0x0) returned 1 [0031.591] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.591] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.591] CloseHandle (hObject=0x114) returned 1 [0031.591] CloseHandle (hObject=0x100) returned 1 [0031.591] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png.crypt")) returned 0 [0031.592] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png.crypt")) returned 0x2020 [0031.592] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAmUyV2[1].png", cAlternateFileName="AAMUYV~1.PNG")) returned 0x5c9000 [0031.592] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAmUyV2[1].png", cAlternateFileName="AAMUYV~1.PNG")) returned 0 [0031.592] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.592] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png")) returned 1 [0031.593] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAmUyV2[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aamuyv2[1].png")) returned 0xffffffff [0031.593] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAn7gKR[1].png", cAlternateFileName="AAN7GK~1.PNG")) returned 1 [0031.593] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png")) returned 0x2020 [0031.593] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.593] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.594] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xfe, lpOverlapped=0x0) returned 1 [0031.595] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xfe, lpOverlapped=0x0) returned 1 [0031.596] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.596] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.596] CloseHandle (hObject=0x100) returned 1 [0031.596] CloseHandle (hObject=0x114) returned 1 [0031.597] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png.crypt")) returned 0 [0031.597] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png.crypt")) returned 0x2020 [0031.597] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAn7gKR[1].png", cAlternateFileName="AAN7GK~1.PNG")) returned 0x5c9000 [0031.597] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAn7gKR[1].png", cAlternateFileName="AAN7GK~1.PNG")) returned 0 [0031.597] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.597] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png")) returned 1 [0031.598] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\AAn7gKR[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\aan7gkr[1].png")) returned 0xffffffff [0031.598] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61be2420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61be2420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61be2420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x650, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1 [0031.598] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2a0770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2a0770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1 [0031.598] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf1f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="adfserve[1]", cAlternateFileName="ADFSER~1")) returned 1 [0031.598] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11835, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="ast[2].js", cAlternateFileName="AST_2_~1.JS")) returned 1 [0031.598] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53d7b330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53d7b330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53d7b330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1 [0031.598] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5108d3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5108d3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e6, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="b2fd15[1].eot", cAlternateFileName="B2FD15~1.EOT")) returned 1 [0031.598] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BB5zDwX[1].png", cAlternateFileName="BB5ZDW~1.PNG")) returned 1 [0031.599] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png")) returned 0x2020 [0031.599] VirtualAlloc (lpAddress=0x1f28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f28000 [0031.599] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.600] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.600] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2c0, lpOverlapped=0x0) returned 1 [0031.601] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2c0, lpOverlapped=0x0) returned 1 [0031.602] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.602] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.602] CloseHandle (hObject=0x114) returned 1 [0031.602] CloseHandle (hObject=0x100) returned 1 [0031.603] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png.crypt")) returned 0 [0031.603] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png.crypt")) returned 0x2020 [0031.603] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB5zDwX[1].png", cAlternateFileName="BB5ZDW~1.PNG")) returned 0x5c9000 [0031.603] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB5zDwX[1].png", cAlternateFileName="BB5ZDW~1.PNG")) returned 0 [0031.603] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.603] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png")) returned 1 [0031.604] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BB5zDwX[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bb5zdwx[1].png")) returned 0xffffffff [0031.604] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBaK3Nm[1].png", cAlternateFileName="BBAK3N~1.PNG")) returned 1 [0031.604] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png")) returned 0x2020 [0031.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.605] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x227, lpOverlapped=0x0) returned 1 [0031.606] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x227, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x227, lpOverlapped=0x0) returned 1 [0031.607] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.607] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.607] CloseHandle (hObject=0x100) returned 1 [0031.607] CloseHandle (hObject=0x114) returned 1 [0031.608] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png.crypt")) returned 0 [0031.609] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png.crypt")) returned 0x2020 [0031.609] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBaK3Nm[1].png", cAlternateFileName="BBAK3N~1.PNG")) returned 0x5c9000 [0031.609] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBaK3Nm[1].png", cAlternateFileName="BBAK3N~1.PNG")) returned 0 [0031.609] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.609] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png")) returned 1 [0031.610] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBaK3Nm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbak3nm[1].png")) returned 0xffffffff [0031.610] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2143, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBLcCz[1].jpg", cAlternateFileName="BBBLCC~1.JPG")) returned 1 [0031.610] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg")) returned 0x2020 [0031.610] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.610] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.611] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.612] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.613] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.614] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.614] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x143, lpOverlapped=0x0) returned 1 [0031.614] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x143, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x143, lpOverlapped=0x0) returned 1 [0031.614] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.614] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.614] CloseHandle (hObject=0x114) returned 1 [0031.614] CloseHandle (hObject=0x100) returned 1 [0031.615] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg.crypt")) returned 0 [0031.615] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg.crypt")) returned 0x2020 [0031.615] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2143, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBLcCz[1].jpg", cAlternateFileName="BBBLCC~1.JPG")) returned 0x5c9000 [0031.615] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2143, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBLcCz[1].jpg", cAlternateFileName="BBBLCC~1.JPG")) returned 0 [0031.616] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.616] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg")) returned 1 [0031.617] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLcCz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbblccz[1].jpg")) returned 0xffffffff [0031.617] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBLdzQ[1].jpg", cAlternateFileName="BBBLDZ~1.JPG")) returned 1 [0031.617] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg")) returned 0x2020 [0031.619] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.619] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.620] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x912, lpOverlapped=0x0) returned 1 [0031.622] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x912, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x912, lpOverlapped=0x0) returned 1 [0031.623] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.623] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.623] CloseHandle (hObject=0x100) returned 1 [0031.623] CloseHandle (hObject=0x114) returned 1 [0031.624] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg.crypt")) returned 0 [0031.624] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg.crypt")) returned 0x2020 [0031.625] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBLdzQ[1].jpg", cAlternateFileName="BBBLDZ~1.JPG")) returned 0x5c9000 [0031.625] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBLdzQ[1].jpg", cAlternateFileName="BBBLDZ~1.JPG")) returned 0 [0031.625] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.625] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg")) returned 1 [0031.626] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBLdzQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbldzq[1].jpg")) returned 0xffffffff [0031.626] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 1 [0031.626] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg")) returned 0x2020 [0031.626] VirtualAlloc (lpAddress=0x1f2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f2c000 [0031.626] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.626] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.627] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x6e8, lpOverlapped=0x0) returned 1 [0031.628] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x6e8, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x6e8, lpOverlapped=0x0) returned 1 [0031.629] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.629] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.629] CloseHandle (hObject=0x114) returned 1 [0031.629] CloseHandle (hObject=0x100) returned 1 [0031.630] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg.crypt")) returned 0 [0031.630] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg.crypt")) returned 0x2020 [0031.630] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 0x5c9000 [0031.631] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO1mQ[1].jpg", cAlternateFileName="BBBO1M~1.JPG")) returned 0 [0031.631] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.631] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg")) returned 1 [0031.632] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1mq[1].jpg")) returned 0xffffffff [0031.632] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36d2, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBO1qB[1].jpg", cAlternateFileName="BBBO1Q~1.JPG")) returned 1 [0031.632] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg")) returned 0x2020 [0031.632] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.632] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.632] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.634] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.635] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.636] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.636] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.636] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.636] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x6d2, lpOverlapped=0x0) returned 1 [0031.636] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x6d2, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x6d2, lpOverlapped=0x0) returned 1 [0031.636] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.636] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.636] CloseHandle (hObject=0x100) returned 1 [0031.636] CloseHandle (hObject=0x114) returned 1 [0031.637] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg.crypt")) returned 0 [0031.637] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg.crypt")) returned 0x2020 [0031.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36d2, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO1qB[1].jpg", cAlternateFileName="BBBO1Q~1.JPG")) returned 0x5c9000 [0031.638] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537add90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x537add90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x537add90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36d2, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO1qB[1].jpg", cAlternateFileName="BBBO1Q~1.JPG")) returned 0 [0031.638] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.638] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg")) returned 1 [0031.639] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBO1qB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbo1qb[1].jpg")) returned 0xffffffff [0031.639] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBOIAt[1].jpg", cAlternateFileName="BBBOIA~1.JPG")) returned 1 [0031.639] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg")) returned 0x2020 [0031.639] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.639] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.640] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x75e, lpOverlapped=0x0) returned 1 [0031.641] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x75e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x75e, lpOverlapped=0x0) returned 1 [0031.642] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.642] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.642] CloseHandle (hObject=0x114) returned 1 [0031.642] CloseHandle (hObject=0x100) returned 1 [0031.643] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg.crypt")) returned 0 [0031.643] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg.crypt")) returned 0x2020 [0031.643] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOIAt[1].jpg", cAlternateFileName="BBBOIA~1.JPG")) returned 0x5c9000 [0031.643] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOIAt[1].jpg", cAlternateFileName="BBBOIA~1.JPG")) returned 0 [0031.643] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.643] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg")) returned 1 [0031.644] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOIAt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbboiat[1].jpg")) returned 0xffffffff [0031.644] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBOmuh[1].jpg", cAlternateFileName="BBBOMU~1.JPG")) returned 1 [0031.644] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg")) returned 0x2020 [0031.644] VirtualAlloc (lpAddress=0x1f30000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f30000 [0031.645] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.645] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.652] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x6dc, lpOverlapped=0x0) returned 1 [0031.653] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x6dc, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x6dc, lpOverlapped=0x0) returned 1 [0031.654] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.654] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.654] CloseHandle (hObject=0x100) returned 1 [0031.654] CloseHandle (hObject=0x114) returned 1 [0031.655] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg.crypt")) returned 0 [0031.655] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg.crypt")) returned 0x2020 [0031.655] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOmuh[1].jpg", cAlternateFileName="BBBOMU~1.JPG")) returned 0x5c9000 [0031.655] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOmuh[1].jpg", cAlternateFileName="BBBOMU~1.JPG")) returned 0 [0031.655] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.655] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg")) returned 1 [0031.656] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBOmuh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbomuh[1].jpg")) returned 0xffffffff [0031.656] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBPK5J[1].jpg", cAlternateFileName="BBBPK5~1.JPG")) returned 1 [0031.656] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg")) returned 0x2020 [0031.657] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.657] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.657] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9be, lpOverlapped=0x0) returned 1 [0031.658] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9be, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9be, lpOverlapped=0x0) returned 1 [0031.659] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.659] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.659] CloseHandle (hObject=0x114) returned 1 [0031.659] CloseHandle (hObject=0x100) returned 1 [0031.660] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg.crypt")) returned 0 [0031.660] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg.crypt")) returned 0x2020 [0031.660] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPK5J[1].jpg", cAlternateFileName="BBBPK5~1.JPG")) returned 0x5c9000 [0031.661] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53467f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53467f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPK5J[1].jpg", cAlternateFileName="BBBPK5~1.JPG")) returned 0 [0031.661] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.661] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg")) returned 1 [0031.662] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPK5J[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpk5j[1].jpg")) returned 0xffffffff [0031.662] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBPMvJ[1].jpg", cAlternateFileName="BBBPMV~1.JPG")) returned 1 [0031.663] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg")) returned 0x2020 [0031.667] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.668] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.668] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.670] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.671] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x694, lpOverlapped=0x0) returned 1 [0031.671] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x694, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x694, lpOverlapped=0x0) returned 1 [0031.671] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.671] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.671] CloseHandle (hObject=0x100) returned 1 [0031.671] CloseHandle (hObject=0x114) returned 1 [0031.672] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg.crypt")) returned 0 [0031.672] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg.crypt")) returned 0x2020 [0031.672] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPMvJ[1].jpg", cAlternateFileName="BBBPMV~1.JPG")) returned 0x5c9000 [0031.672] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53194530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53194530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53194530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBPMvJ[1].jpg", cAlternateFileName="BBBPMV~1.JPG")) returned 0 [0031.672] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.673] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg")) returned 1 [0031.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBPMvJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbpmvj[1].jpg")) returned 0xffffffff [0031.674] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53a0f390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBUL3E[1].jpg", cAlternateFileName="BBBUL3~1.JPG")) returned 1 [0031.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg")) returned 0x2020 [0031.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.674] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x85d, lpOverlapped=0x0) returned 1 [0031.676] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x85d, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x85d, lpOverlapped=0x0) returned 1 [0031.677] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.677] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.677] CloseHandle (hObject=0x114) returned 1 [0031.677] CloseHandle (hObject=0x100) returned 1 [0031.678] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg.crypt")) returned 0 [0031.678] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg.crypt")) returned 0x2020 [0031.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53a0f390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBUL3E[1].jpg", cAlternateFileName="BBBUL3~1.JPG")) returned 0x5c9000 [0031.678] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539e9230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539e9230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53a0f390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBUL3E[1].jpg", cAlternateFileName="BBBUL3~1.JPG")) returned 0 [0031.678] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.679] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg")) returned 1 [0031.679] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUL3E[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbul3e[1].jpg")) returned 0xffffffff [0031.679] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBUqkT[1].jpg", cAlternateFileName="BBBUQK~1.JPG")) returned 1 [0031.680] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg")) returned 0x2020 [0031.680] VirtualAlloc (lpAddress=0x1f34000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f34000 [0031.680] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.680] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.681] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x878, lpOverlapped=0x0) returned 1 [0031.685] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x878, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x878, lpOverlapped=0x0) returned 1 [0031.686] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.686] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.686] CloseHandle (hObject=0x100) returned 1 [0031.686] CloseHandle (hObject=0x114) returned 1 [0031.687] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg.crypt")) returned 0 [0031.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg.crypt")) returned 0x2020 [0031.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBUqkT[1].jpg", cAlternateFileName="BBBUQK~1.JPG")) returned 0x5c9000 [0031.688] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBUqkT[1].jpg", cAlternateFileName="BBBUQK~1.JPG")) returned 0 [0031.688] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.688] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg")) returned 1 [0031.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[1].jpg")) returned 0xffffffff [0031.689] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBUqkT[2].jpg", cAlternateFileName="BBBUQK~2.JPG")) returned 1 [0031.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg")) returned 0x2020 [0031.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.690] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x878, lpOverlapped=0x0) returned 1 [0031.691] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x878, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x878, lpOverlapped=0x0) returned 1 [0031.692] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.692] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.692] CloseHandle (hObject=0x114) returned 1 [0031.693] CloseHandle (hObject=0x100) returned 1 [0031.693] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg.crypt")) returned 0 [0031.693] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg.crypt")) returned 0x2020 [0031.693] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBUqkT[2].jpg", cAlternateFileName="BBBUQK~2.JPG")) returned 0x5c9000 [0031.693] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f59090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f59090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f59090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBUqkT[2].jpg", cAlternateFileName="BBBUQK~2.JPG")) returned 0 [0031.693] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.693] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg")) returned 1 [0031.694] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBUqkT[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbuqkt[2].jpg")) returned 0xffffffff [0031.694] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBX3z0[1].jpg", cAlternateFileName="BBBX3Z~1.JPG")) returned 1 [0031.694] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg")) returned 0x2020 [0031.695] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.695] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.696] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x77f, lpOverlapped=0x0) returned 1 [0031.697] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x77f, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x77f, lpOverlapped=0x0) returned 1 [0031.698] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.698] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.698] CloseHandle (hObject=0x100) returned 1 [0031.698] CloseHandle (hObject=0x114) returned 1 [0031.699] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg.crypt")) returned 0 [0031.699] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg.crypt")) returned 0x2020 [0031.699] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBX3z0[1].jpg", cAlternateFileName="BBBX3Z~1.JPG")) returned 0x5c9000 [0031.699] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBX3z0[1].jpg", cAlternateFileName="BBBX3Z~1.JPG")) returned 0 [0031.699] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.699] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg")) returned 1 [0031.700] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBX3z0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbx3z0[1].jpg")) returned 0xffffffff [0031.700] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22b3, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBYEW1[1].jpg", cAlternateFileName="BBBYEW~1.JPG")) returned 1 [0031.700] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg")) returned 0x2020 [0031.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.701] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.704] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.705] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.705] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.705] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2b3, lpOverlapped=0x0) returned 1 [0031.705] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2b3, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2b3, lpOverlapped=0x0) returned 1 [0031.705] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.705] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.705] CloseHandle (hObject=0x114) returned 1 [0031.705] CloseHandle (hObject=0x100) returned 1 [0031.706] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg.crypt")) returned 0 [0031.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg.crypt")) returned 0x2020 [0031.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22b3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBYEW1[1].jpg", cAlternateFileName="BBBYEW~1.JPG")) returned 0x5c9000 [0031.707] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22b3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBYEW1[1].jpg", cAlternateFileName="BBBYEW~1.JPG")) returned 0 [0031.707] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.707] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg")) returned 1 [0031.708] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYEW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyew1[1].jpg")) returned 0xffffffff [0031.708] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 1 [0031.708] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg")) returned 0x2020 [0031.708] VirtualAlloc (lpAddress=0x1f38000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f38000 [0031.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.709] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.711] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.712] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9cf, lpOverlapped=0x0) returned 1 [0031.712] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9cf, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9cf, lpOverlapped=0x0) returned 1 [0031.713] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.713] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.713] CloseHandle (hObject=0x100) returned 1 [0031.713] CloseHandle (hObject=0x114) returned 1 [0031.713] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg.crypt")) returned 0 [0031.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg.crypt")) returned 0x2020 [0031.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 0x5c9000 [0031.714] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 0 [0031.714] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.714] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg")) returned 1 [0031.715] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbyfeh[1].jpg")) returned 0xffffffff [0031.715] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ca1, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBZ20W[1].jpg", cAlternateFileName="BBBZ20~1.JPG")) returned 1 [0031.715] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg")) returned 0x2020 [0031.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.717] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.718] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.719] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.720] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.720] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xca1, lpOverlapped=0x0) returned 1 [0031.720] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xca1, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xca1, lpOverlapped=0x0) returned 1 [0031.720] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.720] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.720] CloseHandle (hObject=0x114) returned 1 [0031.720] CloseHandle (hObject=0x100) returned 1 [0031.721] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg.crypt")) returned 0 [0031.721] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg.crypt")) returned 0x2020 [0031.721] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ca1, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBZ20W[1].jpg", cAlternateFileName="BBBZ20~1.JPG")) returned 0x5c9000 [0031.721] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ca1, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBZ20W[1].jpg", cAlternateFileName="BBBZ20~1.JPG")) returned 0 [0031.721] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.722] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg")) returned 1 [0031.722] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZ20W[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbz20w[1].jpg")) returned 0xffffffff [0031.723] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53950cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53950cb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBzaxY[1].jpg", cAlternateFileName="BBBZAX~1.JPG")) returned 1 [0031.723] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg")) returned 0x2020 [0031.724] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.724] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.724] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.726] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.727] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xf37, lpOverlapped=0x0) returned 1 [0031.727] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xf37, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xf37, lpOverlapped=0x0) returned 1 [0031.728] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.728] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.728] CloseHandle (hObject=0x100) returned 1 [0031.728] CloseHandle (hObject=0x114) returned 1 [0031.729] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg.crypt")) returned 0 [0031.729] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg.crypt")) returned 0x2020 [0031.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53950cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53950cb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBzaxY[1].jpg", cAlternateFileName="BBBZAX~1.JPG")) returned 0x5c9000 [0031.729] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53950cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53950cb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBzaxY[1].jpg", cAlternateFileName="BBBZAX~1.JPG")) returned 0 [0031.729] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.730] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg")) returned 1 [0031.730] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBzaxY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzaxy[1].jpg")) returned 0xffffffff [0031.730] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2131, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBZzuz[1].jpg", cAlternateFileName="BBBZZU~1.JPG")) returned 1 [0031.731] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg")) returned 0x2020 [0031.731] VirtualAlloc (lpAddress=0x1f3c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f3c000 [0031.731] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.731] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.732] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.733] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.734] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.735] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.735] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x131, lpOverlapped=0x0) returned 1 [0031.735] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x131, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x131, lpOverlapped=0x0) returned 1 [0031.735] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.735] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.735] CloseHandle (hObject=0x114) returned 1 [0031.735] CloseHandle (hObject=0x100) returned 1 [0031.736] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg.crypt")) returned 0 [0031.737] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg.crypt")) returned 0x2020 [0031.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2131, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBZzuz[1].jpg", cAlternateFileName="BBBZZU~1.JPG")) returned 0x5c9000 [0031.737] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2131, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBZzuz[1].jpg", cAlternateFileName="BBBZZU~1.JPG")) returned 0 [0031.737] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.737] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg")) returned 1 [0031.740] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBBZzuz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbbzzuz[1].jpg")) returned 0xffffffff [0031.740] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x370a, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 1 [0031.740] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg")) returned 0x2020 [0031.741] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.741] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.741] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.745] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.746] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.746] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.746] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.746] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.747] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x70a, lpOverlapped=0x0) returned 1 [0031.747] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x70a, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x70a, lpOverlapped=0x0) returned 1 [0031.747] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.747] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.747] CloseHandle (hObject=0x100) returned 1 [0031.747] CloseHandle (hObject=0x114) returned 1 [0031.748] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg.crypt")) returned 0 [0031.748] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg.crypt")) returned 0x2020 [0031.748] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x370a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 0x5c9000 [0031.748] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5530da90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5530da90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5530da90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x370a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 0 [0031.748] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.748] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg")) returned 1 [0031.749] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc03b1[1].jpg")) returned 0xffffffff [0031.749] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 1 [0031.750] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg")) returned 0x2020 [0031.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.750] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.752] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.753] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.753] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.753] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2a0, lpOverlapped=0x0) returned 1 [0031.754] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2a0, lpOverlapped=0x0) returned 1 [0031.754] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.754] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.754] CloseHandle (hObject=0x114) returned 1 [0031.754] CloseHandle (hObject=0x100) returned 1 [0031.755] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg.crypt")) returned 0 [0031.755] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg.crypt")) returned 0x2020 [0031.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 0x5c9000 [0031.755] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC04o2[1].jpg", cAlternateFileName="BBC04O~1.JPG")) returned 0 [0031.755] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.756] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg")) returned 1 [0031.756] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC04o2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc04o2[1].jpg")) returned 0xffffffff [0031.757] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53657130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53657130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2036, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC06ZQ[1].jpg", cAlternateFileName="BBC06Z~1.JPG")) returned 1 [0031.757] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg")) returned 0x2020 [0031.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.757] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.757] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.760] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.761] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.761] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.761] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x36, lpOverlapped=0x0) returned 1 [0031.761] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x36, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x36, lpOverlapped=0x0) returned 1 [0031.761] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.761] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.761] CloseHandle (hObject=0x100) returned 1 [0031.761] CloseHandle (hObject=0x114) returned 1 [0031.762] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg.crypt")) returned 0 [0031.763] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg.crypt")) returned 0x2020 [0031.763] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53657130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53657130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2036, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC06ZQ[1].jpg", cAlternateFileName="BBC06Z~1.JPG")) returned 0x5c9000 [0031.763] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53657130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53657130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53657130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2036, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC06ZQ[1].jpg", cAlternateFileName="BBC06Z~1.JPG")) returned 0 [0031.763] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.763] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg")) returned 1 [0031.764] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC06ZQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc06zq[1].jpg")) returned 0xffffffff [0031.764] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13fd, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 1 [0031.764] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg")) returned 0x2020 [0031.764] VirtualAlloc (lpAddress=0x1f40000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f40000 [0031.764] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.765] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.765] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.767] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.768] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x3fd, lpOverlapped=0x0) returned 1 [0031.768] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x3fd, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x3fd, lpOverlapped=0x0) returned 1 [0031.768] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.768] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.768] CloseHandle (hObject=0x114) returned 1 [0031.768] CloseHandle (hObject=0x100) returned 1 [0031.769] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg.crypt")) returned 0 [0031.769] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg.crypt")) returned 0x2020 [0031.769] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13fd, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 0x5c9000 [0031.770] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2bd440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2bd440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2bd440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13fd, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0ALC[1].jpg", cAlternateFileName="BBC0AL~1.JPG")) returned 0 [0031.770] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.770] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg")) returned 1 [0031.771] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0alc[1].jpg")) returned 0xffffffff [0031.771] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0BiZ[1].jpg", cAlternateFileName="BBC0BI~1.JPG")) returned 1 [0031.771] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg")) returned 0x2020 [0031.771] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.771] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.771] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x884, lpOverlapped=0x0) returned 1 [0031.773] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x884, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x884, lpOverlapped=0x0) returned 1 [0031.774] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.774] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.774] CloseHandle (hObject=0x100) returned 1 [0031.774] CloseHandle (hObject=0x114) returned 1 [0031.775] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg.crypt")) returned 0 [0031.775] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg.crypt")) returned 0x2020 [0031.775] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0BiZ[1].jpg", cAlternateFileName="BBC0BI~1.JPG")) returned 0x5c9000 [0031.775] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0BiZ[1].jpg", cAlternateFileName="BBC0BI~1.JPG")) returned 0 [0031.775] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.775] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg")) returned 1 [0031.776] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0BiZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0biz[1].jpg")) returned 0xffffffff [0031.776] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0FXU[1].jpg", cAlternateFileName="BBC0FX~1.JPG")) returned 1 [0031.776] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg")) returned 0x2020 [0031.776] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.777] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.777] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.779] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.780] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.780] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.780] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.780] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.781] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x4d8, lpOverlapped=0x0) returned 1 [0031.781] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x4d8, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x4d8, lpOverlapped=0x0) returned 1 [0031.781] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.781] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.781] CloseHandle (hObject=0x114) returned 1 [0031.781] CloseHandle (hObject=0x100) returned 1 [0031.782] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg.crypt")) returned 0 [0031.782] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg.crypt")) returned 0x2020 [0031.782] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0FXU[1].jpg", cAlternateFileName="BBC0FX~1.JPG")) returned 0x5c9000 [0031.782] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0FXU[1].jpg", cAlternateFileName="BBC0FX~1.JPG")) returned 0 [0031.782] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.782] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg")) returned 1 [0031.783] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[1].jpg")) returned 0xffffffff [0031.783] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2fd1, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0FXU[2].jpg", cAlternateFileName="BBC0FX~2.JPG")) returned 1 [0031.783] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg")) returned 0x2020 [0031.791] VirtualAlloc (lpAddress=0x1f44000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f44000 [0031.792] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.792] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.792] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.794] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.795] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.795] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.795] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xfd1, lpOverlapped=0x0) returned 1 [0031.796] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xfd1, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xfd1, lpOverlapped=0x0) returned 1 [0031.796] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.796] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.796] CloseHandle (hObject=0x100) returned 1 [0031.796] CloseHandle (hObject=0x114) returned 1 [0031.797] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg.crypt")) returned 0 [0031.797] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg.crypt")) returned 0x2020 [0031.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2fd1, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0FXU[2].jpg", cAlternateFileName="BBC0FX~2.JPG")) returned 0x5c9000 [0031.797] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2fd1, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0FXU[2].jpg", cAlternateFileName="BBC0FX~2.JPG")) returned 0 [0031.797] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.797] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg")) returned 1 [0031.798] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0FXU[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0fxu[2].jpg")) returned 0xffffffff [0031.798] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0mkg[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 1 [0031.798] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg")) returned 0x2020 [0031.799] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.799] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.799] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.801] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.802] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.802] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.802] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9c3, lpOverlapped=0x0) returned 1 [0031.803] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9c3, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9c3, lpOverlapped=0x0) returned 1 [0031.803] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.803] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.803] CloseHandle (hObject=0x114) returned 1 [0031.803] CloseHandle (hObject=0x100) returned 1 [0031.804] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg.crypt")) returned 0 [0031.804] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg.crypt")) returned 0x2020 [0031.804] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0mkg[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 0x5c9000 [0031.804] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0mkg[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 0 [0031.804] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.804] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg")) returned 1 [0031.805] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[1].jpg")) returned 0xffffffff [0031.805] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0mkg[2].jpg", cAlternateFileName="BBC0MK~2.JPG")) returned 1 [0031.805] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg")) returned 0x2020 [0031.806] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.806] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.806] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xa7b, lpOverlapped=0x0) returned 1 [0031.807] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xa7b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xa7b, lpOverlapped=0x0) returned 1 [0031.808] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.808] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.808] CloseHandle (hObject=0x100) returned 1 [0031.808] CloseHandle (hObject=0x114) returned 1 [0031.809] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg.crypt")) returned 0 [0031.809] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg.crypt")) returned 0x2020 [0031.809] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0mkg[2].jpg", cAlternateFileName="BBC0MK~2.JPG")) returned 0x5c9000 [0031.810] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e9a9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e9a9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e9a9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0mkg[2].jpg", cAlternateFileName="BBC0MK~2.JPG")) returned 0 [0031.810] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.810] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg")) returned 1 [0031.811] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0mkg[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0mkg[2].jpg")) returned 0xffffffff [0031.811] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5127c5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5127c5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5127c5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17af, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0oQi[1].jpg", cAlternateFileName="BBC0OQ~1.JPG")) returned 1 [0031.811] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg")) returned 0x2020 [0031.811] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.811] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.814] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.816] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.817] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7af, lpOverlapped=0x0) returned 1 [0031.817] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7af, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7af, lpOverlapped=0x0) returned 1 [0031.818] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.818] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.818] CloseHandle (hObject=0x114) returned 1 [0031.818] CloseHandle (hObject=0x100) returned 1 [0031.819] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg.crypt")) returned 0 [0031.819] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg.crypt")) returned 0x2020 [0031.819] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5127c5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5127c5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5127c5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17af, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0oQi[1].jpg", cAlternateFileName="BBC0OQ~1.JPG")) returned 0x5c9000 [0031.819] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5127c5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5127c5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5127c5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17af, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0oQi[1].jpg", cAlternateFileName="BBC0OQ~1.JPG")) returned 0 [0031.819] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.819] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg")) returned 1 [0031.820] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0oQi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0oqi[1].jpg")) returned 0xffffffff [0031.820] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 1 [0031.820] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg")) returned 0x2020 [0031.820] VirtualAlloc (lpAddress=0x1f48000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f48000 [0031.821] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.821] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.821] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xaf3, lpOverlapped=0x0) returned 1 [0031.823] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xaf3, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xaf3, lpOverlapped=0x0) returned 1 [0031.823] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.823] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.823] CloseHandle (hObject=0x100) returned 1 [0031.824] CloseHandle (hObject=0x114) returned 1 [0031.824] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg.crypt")) returned 0 [0031.824] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg.crypt")) returned 0x2020 [0031.825] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 0x5c9000 [0031.825] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0tCi[1].jpg", cAlternateFileName="BBC0TC~1.JPG")) returned 0 [0031.825] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.825] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg")) returned 1 [0031.826] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbc0tci[1].jpg")) returned 0xffffffff [0031.826] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x350a, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBCM2U2[1].jpg", cAlternateFileName="BBCM2U~1.JPG")) returned 1 [0031.826] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg")) returned 0x2020 [0031.826] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.826] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.827] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.829] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.830] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.830] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.830] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.830] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.831] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x50a, lpOverlapped=0x0) returned 1 [0031.831] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x50a, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x50a, lpOverlapped=0x0) returned 1 [0031.831] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.831] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.831] CloseHandle (hObject=0x114) returned 1 [0031.831] CloseHandle (hObject=0x100) returned 1 [0031.832] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg.crypt")) returned 0 [0031.832] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg.crypt")) returned 0x2020 [0031.832] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x350a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBCM2U2[1].jpg", cAlternateFileName="BBCM2U~1.JPG")) returned 0x5c9000 [0031.832] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x350a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBCM2U2[1].jpg", cAlternateFileName="BBCM2U~1.JPG")) returned 0 [0031.832] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.833] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg")) returned 1 [0031.834] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBCM2U2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbcm2u2[1].jpg")) returned 0xffffffff [0031.834] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBDGTbx[1].jpg", cAlternateFileName="BBDGTB~1.JPG")) returned 1 [0031.834] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg")) returned 0x2020 [0031.834] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.834] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.834] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x68c, lpOverlapped=0x0) returned 1 [0031.836] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x68c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x68c, lpOverlapped=0x0) returned 1 [0031.837] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.837] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.837] CloseHandle (hObject=0x100) returned 1 [0031.837] CloseHandle (hObject=0x114) returned 1 [0031.837] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg.crypt")) returned 0 [0031.838] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg.crypt")) returned 0x2020 [0031.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDGTbx[1].jpg", cAlternateFileName="BBDGTB~1.JPG")) returned 0x5c9000 [0031.838] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDGTbx[1].jpg", cAlternateFileName="BBDGTB~1.JPG")) returned 0 [0031.838] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.838] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg")) returned 1 [0031.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDGTbx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdgtbx[1].jpg")) returned 0xffffffff [0031.839] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBDk44m[1].png", cAlternateFileName="BBDK44~1.PNG")) returned 1 [0031.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png")) returned 0x2020 [0031.839] VirtualAlloc (lpAddress=0x1f4c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f4c000 [0031.839] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.840] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x284, lpOverlapped=0x0) returned 1 [0031.841] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x284, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x284, lpOverlapped=0x0) returned 1 [0031.842] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.842] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.842] CloseHandle (hObject=0x114) returned 1 [0031.842] CloseHandle (hObject=0x100) returned 1 [0031.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png.crypt")) returned 0 [0031.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png.crypt")) returned 0x2020 [0031.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDk44m[1].png", cAlternateFileName="BBDK44~1.PNG")) returned 0x5c9000 [0031.844] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDk44m[1].png", cAlternateFileName="BBDK44~1.PNG")) returned 0 [0031.844] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.844] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png")) returned 1 [0031.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDk44m[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdk44m[1].png")) returned 0xffffffff [0031.845] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d04, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBDWXoC[1].jpg", cAlternateFileName="BBDWXO~1.JPG")) returned 1 [0031.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg")) returned 0x2020 [0031.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.845] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.848] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.849] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.849] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.849] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xd04, lpOverlapped=0x0) returned 1 [0031.849] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xd04, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xd04, lpOverlapped=0x0) returned 1 [0031.849] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.849] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.850] CloseHandle (hObject=0x100) returned 1 [0031.850] CloseHandle (hObject=0x114) returned 1 [0031.850] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg.crypt")) returned 0 [0031.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg.crypt")) returned 0x2020 [0031.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d04, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDWXoC[1].jpg", cAlternateFileName="BBDWXO~1.JPG")) returned 0x5c9000 [0031.851] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d04, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBDWXoC[1].jpg", cAlternateFileName="BBDWXO~1.JPG")) returned 0 [0031.851] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.851] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg")) returned 1 [0031.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBDWXoC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbdwxoc[1].jpg")) returned 0xffffffff [0031.852] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBE3NcH[1].jpg", cAlternateFileName="BBE3NC~1.JPG")) returned 1 [0031.852] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg")) returned 0x2020 [0031.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.853] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x863, lpOverlapped=0x0) returned 1 [0031.854] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x863, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x863, lpOverlapped=0x0) returned 1 [0031.855] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.855] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.855] CloseHandle (hObject=0x114) returned 1 [0031.855] CloseHandle (hObject=0x100) returned 1 [0031.856] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg.crypt")) returned 0 [0031.856] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg.crypt")) returned 0x2020 [0031.856] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE3NcH[1].jpg", cAlternateFileName="BBE3NC~1.JPG")) returned 0x5c9000 [0031.856] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE3NcH[1].jpg", cAlternateFileName="BBE3NC~1.JPG")) returned 0 [0031.856] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.856] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg")) returned 1 [0031.857] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE3NcH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe3nch[1].jpg")) returned 0xffffffff [0031.857] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBE7GLE[1].png", cAlternateFileName="BBE7GL~1.PNG")) returned 1 [0031.857] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png")) returned 0x2020 [0031.857] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.858] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.858] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2b5, lpOverlapped=0x0) returned 1 [0031.859] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2b5, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2b5, lpOverlapped=0x0) returned 1 [0031.860] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.860] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.860] CloseHandle (hObject=0x100) returned 1 [0031.860] CloseHandle (hObject=0x114) returned 1 [0031.861] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png.crypt")) returned 0 [0031.862] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png.crypt")) returned 0x2020 [0031.862] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE7GLE[1].png", cAlternateFileName="BBE7GL~1.PNG")) returned 0x5c9000 [0031.862] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE7GLE[1].png", cAlternateFileName="BBE7GL~1.PNG")) returned 0 [0031.862] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.862] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png")) returned 1 [0031.863] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE7GLE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe7gle[1].png")) returned 0xffffffff [0031.863] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ade190, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ade190, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c9b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBE8aLO[1].jpg", cAlternateFileName="BBE8AL~1.JPG")) returned 1 [0031.863] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg")) returned 0x2020 [0031.863] VirtualAlloc (lpAddress=0x1f50000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f50000 [0031.863] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.863] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.869] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.871] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.872] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xc9b, lpOverlapped=0x0) returned 1 [0031.872] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xc9b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xc9b, lpOverlapped=0x0) returned 1 [0031.872] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.872] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.873] CloseHandle (hObject=0x114) returned 1 [0031.873] CloseHandle (hObject=0x100) returned 1 [0031.873] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg.crypt")) returned 0 [0031.873] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg.crypt")) returned 0x2020 [0031.874] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ade190, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ade190, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c9b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE8aLO[1].jpg", cAlternateFileName="BBE8AL~1.JPG")) returned 0x5c9000 [0031.874] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ade190, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ade190, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c9b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE8aLO[1].jpg", cAlternateFileName="BBE8AL~1.JPG")) returned 0 [0031.874] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.874] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg")) returned 1 [0031.875] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBE8aLO[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbe8alo[1].jpg")) returned 0xffffffff [0031.875] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEd5bF[1].jpg", cAlternateFileName="BBED5B~1.JPG")) returned 1 [0031.875] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg")) returned 0x2020 [0031.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.876] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x702, lpOverlapped=0x0) returned 1 [0031.880] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x702, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x702, lpOverlapped=0x0) returned 1 [0031.880] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.881] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.881] CloseHandle (hObject=0x100) returned 1 [0031.881] CloseHandle (hObject=0x114) returned 1 [0031.882] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg.crypt")) returned 0 [0031.882] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg.crypt")) returned 0x2020 [0031.882] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEd5bF[1].jpg", cAlternateFileName="BBED5B~1.JPG")) returned 0x5c9000 [0031.882] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a45c10, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a45c10, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a45c10, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEd5bF[1].jpg", cAlternateFileName="BBED5B~1.JPG")) returned 0 [0031.882] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.882] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg")) returned 1 [0031.883] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEd5bF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbed5bf[1].jpg")) returned 0xffffffff [0031.883] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaca8, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEdDNm[1].jpg", cAlternateFileName="BBEDDN~1.JPG")) returned 1 [0031.883] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg")) returned 0x2020 [0031.884] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.884] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.884] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.893] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.894] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.894] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.894] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.895] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.895] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.895] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.895] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.895] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.895] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.896] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.896] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.896] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.896] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.896] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.896] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.896] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.897] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.897] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.897] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xca8, lpOverlapped=0x0) returned 1 [0031.897] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xca8, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xca8, lpOverlapped=0x0) returned 1 [0031.897] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.897] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.897] CloseHandle (hObject=0x114) returned 1 [0031.897] CloseHandle (hObject=0x100) returned 1 [0031.899] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg.crypt")) returned 0 [0031.899] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg.crypt")) returned 0x2020 [0031.899] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaca8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdDNm[1].jpg", cAlternateFileName="BBEDDN~1.JPG")) returned 0x5c9000 [0031.899] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50ebbff0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50ebbff0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50ebbff0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xaca8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdDNm[1].jpg", cAlternateFileName="BBEDDN~1.JPG")) returned 0 [0031.899] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.899] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg")) returned 1 [0031.900] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdDNm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeddnm[1].jpg")) returned 0xffffffff [0031.900] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEdpyr[1].jpg", cAlternateFileName="BBEDPY~1.JPG")) returned 1 [0031.900] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg")) returned 0x2020 [0031.901] VirtualAlloc (lpAddress=0x1f54000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f54000 [0031.901] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.901] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.901] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x755, lpOverlapped=0x0) returned 1 [0031.903] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x755, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x755, lpOverlapped=0x0) returned 1 [0031.904] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.904] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.904] CloseHandle (hObject=0x100) returned 1 [0031.904] CloseHandle (hObject=0x114) returned 1 [0031.904] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg.crypt")) returned 0 [0031.905] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg.crypt")) returned 0x2020 [0031.905] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdpyr[1].jpg", cAlternateFileName="BBEDPY~1.JPG")) returned 0x5c9000 [0031.905] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdpyr[1].jpg", cAlternateFileName="BBEDPY~1.JPG")) returned 0 [0031.905] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.905] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg")) returned 1 [0031.906] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdpyr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedpyr[1].jpg")) returned 0xffffffff [0031.906] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c72, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEdQdv[1].jpg", cAlternateFileName="BBEDQD~1.JPG")) returned 1 [0031.906] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg")) returned 0x2020 [0031.906] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.906] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.907] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.910] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.911] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xc72, lpOverlapped=0x0) returned 1 [0031.912] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xc72, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xc72, lpOverlapped=0x0) returned 1 [0031.912] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.912] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.912] CloseHandle (hObject=0x114) returned 1 [0031.912] CloseHandle (hObject=0x100) returned 1 [0031.913] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg.crypt")) returned 0 [0031.913] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg.crypt")) returned 0x2020 [0031.913] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c72, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdQdv[1].jpg", cAlternateFileName="BBEDQD~1.JPG")) returned 0x5c9000 [0031.913] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c72, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdQdv[1].jpg", cAlternateFileName="BBEDQD~1.JPG")) returned 0 [0031.913] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.913] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg")) returned 1 [0031.914] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEdQdv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbedqdv[1].jpg")) returned 0xffffffff [0031.914] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xa23, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEe62t[1].jpg", cAlternateFileName="BBEE62~1.JPG")) returned 1 [0031.916] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg")) returned 0x2020 [0031.916] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.916] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.917] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xa23, lpOverlapped=0x0) returned 1 [0031.918] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xa23, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xa23, lpOverlapped=0x0) returned 1 [0031.919] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.919] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.919] CloseHandle (hObject=0x100) returned 1 [0031.919] CloseHandle (hObject=0x114) returned 1 [0031.920] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg.crypt")) returned 0 [0031.920] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg.crypt")) returned 0x2020 [0031.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xa23, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEe62t[1].jpg", cAlternateFileName="BBEE62~1.JPG")) returned 0x5c9000 [0031.920] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe399c90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe399c90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe399c90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xa23, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEe62t[1].jpg", cAlternateFileName="BBEE62~1.JPG")) returned 0 [0031.920] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.921] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg")) returned 1 [0031.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEe62t[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbee62t[1].jpg")) returned 0xffffffff [0031.921] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEedPR[1].jpg", cAlternateFileName="BBEEDP~1.JPG")) returned 1 [0031.922] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg")) returned 0x2020 [0031.922] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.922] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.922] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.924] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.925] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xca7, lpOverlapped=0x0) returned 1 [0031.925] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xca7, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xca7, lpOverlapped=0x0) returned 1 [0031.925] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.925] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.925] CloseHandle (hObject=0x114) returned 1 [0031.925] CloseHandle (hObject=0x100) returned 1 [0031.926] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg.crypt")) returned 0 [0031.927] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg.crypt")) returned 0x2020 [0031.927] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEedPR[1].jpg", cAlternateFileName="BBEEDP~1.JPG")) returned 0x5c9000 [0031.927] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEedPR[1].jpg", cAlternateFileName="BBEEDP~1.JPG")) returned 0 [0031.927] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.927] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg")) returned 1 [0031.928] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEedPR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeedpr[1].jpg")) returned 0xffffffff [0031.928] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe34d9d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe34d9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeTpB[1].jpg", cAlternateFileName="BBEETP~1.JPG")) returned 1 [0031.928] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg")) returned 0x2020 [0031.928] VirtualAlloc (lpAddress=0x1f58000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f58000 [0031.928] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.928] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.929] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9ef, lpOverlapped=0x0) returned 1 [0031.930] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9ef, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9ef, lpOverlapped=0x0) returned 1 [0031.931] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.931] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.931] CloseHandle (hObject=0x100) returned 1 [0031.931] CloseHandle (hObject=0x114) returned 1 [0031.932] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg.crypt")) returned 0 [0031.932] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg.crypt")) returned 0x2020 [0031.932] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe34d9d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe34d9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeTpB[1].jpg", cAlternateFileName="BBEETP~1.JPG")) returned 0x5c9000 [0031.932] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe34d9d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe34d9d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe34d9d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeTpB[1].jpg", cAlternateFileName="BBEETP~1.JPG")) returned 0 [0031.932] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.932] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg")) returned 1 [0031.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTpB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetpb[1].jpg")) returned 0xffffffff [0031.933] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 1 [0031.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg")) returned 0x2020 [0031.934] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.934] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.935] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x952, lpOverlapped=0x0) returned 1 [0031.936] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x952, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x952, lpOverlapped=0x0) returned 1 [0031.937] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.937] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.937] CloseHandle (hObject=0x114) returned 1 [0031.937] CloseHandle (hObject=0x100) returned 1 [0031.938] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg.crypt")) returned 0 [0031.938] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg.crypt")) returned 0x2020 [0031.938] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 0x5c9000 [0031.939] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeTuf[1].jpg", cAlternateFileName="BBEETU~1.JPG")) returned 0 [0031.939] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.939] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg")) returned 1 [0031.940] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeetuf[1].jpg")) returned 0xffffffff [0031.940] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeU5U[1].jpg", cAlternateFileName="BBEEU5~1.JPG")) returned 1 [0031.940] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg")) returned 0x2020 [0031.940] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.940] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.940] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7a9, lpOverlapped=0x0) returned 1 [0031.944] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7a9, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7a9, lpOverlapped=0x0) returned 1 [0031.945] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.945] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.945] CloseHandle (hObject=0x100) returned 1 [0031.945] CloseHandle (hObject=0x114) returned 1 [0031.946] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg.crypt")) returned 0 [0031.946] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg.crypt")) returned 0x2020 [0031.946] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeU5U[1].jpg", cAlternateFileName="BBEEU5~1.JPG")) returned 0x5c9000 [0031.947] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeU5U[1].jpg", cAlternateFileName="BBEEU5~1.JPG")) returned 0 [0031.947] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.947] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg")) returned 1 [0031.948] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEeU5U[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbeeu5u[1].jpg")) returned 0xffffffff [0031.948] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x86f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEf306[1].jpg", cAlternateFileName="BBEF30~1.JPG")) returned 1 [0031.948] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg")) returned 0x2020 [0031.948] VirtualAlloc (lpAddress=0x1f5c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f5c000 [0031.948] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.948] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.949] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x86f, lpOverlapped=0x0) returned 1 [0031.950] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x86f, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x86f, lpOverlapped=0x0) returned 1 [0031.951] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.951] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.951] CloseHandle (hObject=0x114) returned 1 [0031.951] CloseHandle (hObject=0x100) returned 1 [0031.952] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg.crypt")) returned 0 [0031.952] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg.crypt")) returned 0x2020 [0031.952] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x86f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEf306[1].jpg", cAlternateFileName="BBEF30~1.JPG")) returned 0x5c9000 [0031.953] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x86f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEf306[1].jpg", cAlternateFileName="BBEF30~1.JPG")) returned 0 [0031.953] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.953] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg")) returned 1 [0031.954] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf306[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef306[1].jpg")) returned 0xffffffff [0031.954] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEf54R[1].jpg", cAlternateFileName="BBEF54~1.JPG")) returned 1 [0031.954] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg")) returned 0x2020 [0031.954] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.954] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.954] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x828, lpOverlapped=0x0) returned 1 [0031.956] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x828, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x828, lpOverlapped=0x0) returned 1 [0031.957] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.957] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.957] CloseHandle (hObject=0x100) returned 1 [0031.957] CloseHandle (hObject=0x114) returned 1 [0031.958] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg.crypt")) returned 0 [0031.958] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg.crypt")) returned 0x2020 [0031.958] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEf54R[1].jpg", cAlternateFileName="BBEF54~1.JPG")) returned 0x5c9000 [0031.958] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459613d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEf54R[1].jpg", cAlternateFileName="BBEF54~1.JPG")) returned 0 [0031.958] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.958] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg")) returned 1 [0031.959] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEf54R[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbef54r[1].jpg")) returned 0xffffffff [0031.959] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3860, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfBbH[1].jpg", cAlternateFileName="BBEFBB~1.JPG")) returned 1 [0031.959] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg")) returned 0x2020 [0031.959] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.960] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.960] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.962] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.963] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.963] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.963] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.964] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.964] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x860, lpOverlapped=0x0) returned 1 [0031.964] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x860, lpOverlapped=0x0) returned 1 [0031.964] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.964] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.964] CloseHandle (hObject=0x114) returned 1 [0031.964] CloseHandle (hObject=0x100) returned 1 [0031.965] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg.crypt")) returned 0 [0031.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg.crypt")) returned 0x2020 [0031.965] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3860, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfBbH[1].jpg", cAlternateFileName="BBEFBB~1.JPG")) returned 0x5c9000 [0031.965] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4587cb90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4587cb90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4587cb90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3860, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfBbH[1].jpg", cAlternateFileName="BBEFBB~1.JPG")) returned 0 [0031.966] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.966] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg")) returned 1 [0031.967] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBbH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbbh[1].jpg")) returned 0xffffffff [0031.967] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a5, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfBq0[1].jpg", cAlternateFileName="BBEFBQ~1.JPG")) returned 1 [0031.967] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg")) returned 0x2020 [0031.967] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.967] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.967] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.969] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.970] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9a5, lpOverlapped=0x0) returned 1 [0031.970] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9a5, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9a5, lpOverlapped=0x0) returned 1 [0031.971] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.971] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.971] CloseHandle (hObject=0x100) returned 1 [0031.971] CloseHandle (hObject=0x114) returned 1 [0031.971] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg.crypt")) returned 0 [0031.972] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg.crypt")) returned 0x2020 [0031.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfBq0[1].jpg", cAlternateFileName="BBEFBQ~1.JPG")) returned 0x5c9000 [0031.972] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19a5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfBq0[1].jpg", cAlternateFileName="BBEFBQ~1.JPG")) returned 0 [0031.972] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.972] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg")) returned 1 [0031.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBq0[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbq0[1].jpg")) returned 0xffffffff [0031.973] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2619, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfBrz[1].jpg", cAlternateFileName="BBEFBR~1.JPG")) returned 1 [0031.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg")) returned 0x2020 [0031.973] VirtualAlloc (lpAddress=0x1f60000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f60000 [0031.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.974] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.976] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.977] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.977] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.977] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x619, lpOverlapped=0x0) returned 1 [0031.977] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x619, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x619, lpOverlapped=0x0) returned 1 [0031.978] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.978] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.978] CloseHandle (hObject=0x114) returned 1 [0031.978] CloseHandle (hObject=0x100) returned 1 [0031.978] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg.crypt")) returned 0 [0031.979] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg.crypt")) returned 0x2020 [0031.979] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2619, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfBrz[1].jpg", cAlternateFileName="BBEFBR~1.JPG")) returned 0x5c9000 [0031.979] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2619, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfBrz[1].jpg", cAlternateFileName="BBEFBR~1.JPG")) returned 0 [0031.979] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.979] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg")) returned 1 [0031.980] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfBrz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefbrz[1].jpg")) returned 0xffffffff [0031.980] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f84, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfXl6[1].jpg", cAlternateFileName="BBEFXL~1.JPG")) returned 1 [0031.980] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg")) returned 0x2020 [0031.980] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.980] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.981] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.983] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.984] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xf84, lpOverlapped=0x0) returned 1 [0031.984] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xf84, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xf84, lpOverlapped=0x0) returned 1 [0031.984] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.984] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.984] CloseHandle (hObject=0x100) returned 1 [0031.984] CloseHandle (hObject=0x114) returned 1 [0031.985] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg.crypt")) returned 0 [0031.985] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg.crypt")) returned 0x2020 [0031.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f84, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfXl6[1].jpg", cAlternateFileName="BBEFXL~1.JPG")) returned 0x5c9000 [0031.985] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b76710, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b76710, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b76710, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1f84, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfXl6[1].jpg", cAlternateFileName="BBEFXL~1.JPG")) returned 0 [0031.985] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.985] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg")) returned 1 [0031.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEfXl6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbefxl6[1].jpg")) returned 0xffffffff [0031.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbded7090, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbded7090, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbded7090, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgEH3[1].jpg", cAlternateFileName="BBEGEH~1.JPG")) returned 1 [0031.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg")) returned 0x2020 [0031.987] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.987] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.987] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.989] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0031.990] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xc7e, lpOverlapped=0x0) returned 1 [0031.990] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xc7e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xc7e, lpOverlapped=0x0) returned 1 [0031.990] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.990] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.990] CloseHandle (hObject=0x114) returned 1 [0031.991] CloseHandle (hObject=0x100) returned 1 [0031.991] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg.crypt")) returned 0 [0031.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg.crypt")) returned 0x2020 [0031.992] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbded7090, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbded7090, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbded7090, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgEH3[1].jpg", cAlternateFileName="BBEGEH~1.JPG")) returned 0x5c9000 [0031.992] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbded7090, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbded7090, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbded7090, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c7e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgEH3[1].jpg", cAlternateFileName="BBEGEH~1.JPG")) returned 0 [0031.992] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.992] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg")) returned 1 [0031.993] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgEH3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegeh3[1].jpg")) returned 0xffffffff [0031.993] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 1 [0031.993] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg")) returned 0x2020 [0031.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.994] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x8f9, lpOverlapped=0x0) returned 1 [0031.995] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x8f9, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x8f9, lpOverlapped=0x0) returned 1 [0031.996] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.996] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0031.996] CloseHandle (hObject=0x100) returned 1 [0031.996] CloseHandle (hObject=0x114) returned 1 [0031.997] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg.crypt")) returned 0 [0031.997] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg.crypt")) returned 0x2020 [0031.997] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 0x5c9000 [0031.997] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgsz3[1].jpg", cAlternateFileName="BBEGSZ~1.JPG")) returned 0 [0031.997] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0031.997] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg")) returned 1 [0031.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegsz3[1].jpg")) returned 0xffffffff [0031.998] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgTxB[1].jpg", cAlternateFileName="BBEGTX~1.JPG")) returned 1 [0031.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg")) returned 0x2020 [0031.998] VirtualAlloc (lpAddress=0x1f64000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f64000 [0031.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0031.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0031.999] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9b7, lpOverlapped=0x0) returned 1 [0032.001] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9b7, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9b7, lpOverlapped=0x0) returned 1 [0032.002] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.002] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.002] CloseHandle (hObject=0x114) returned 1 [0032.002] CloseHandle (hObject=0x100) returned 1 [0032.002] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg.crypt")) returned 0 [0032.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg.crypt")) returned 0x2020 [0032.003] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgTxB[1].jpg", cAlternateFileName="BBEGTX~1.JPG")) returned 0x5c9000 [0032.003] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4574c090, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgTxB[1].jpg", cAlternateFileName="BBEGTX~1.JPG")) returned 0 [0032.003] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.003] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg")) returned 1 [0032.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBEgTxB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbegtxb[1].jpg")) returned 0xffffffff [0032.004] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBo1lFJ[2].png", cAlternateFileName="BBO1LF~2.PNG")) returned 1 [0032.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png")) returned 0x2020 [0032.026] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.027] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.027] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x36e, lpOverlapped=0x0) returned 1 [0032.028] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x36e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x36e, lpOverlapped=0x0) returned 1 [0032.029] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.029] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.029] CloseHandle (hObject=0x100) returned 1 [0032.029] CloseHandle (hObject=0x114) returned 1 [0032.030] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png.crypt")) returned 0 [0032.031] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png.crypt")) returned 0x2020 [0032.031] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBo1lFJ[2].png", cAlternateFileName="BBO1LF~2.PNG")) returned 0x5c9000 [0032.031] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBo1lFJ[2].png", cAlternateFileName="BBO1LF~2.PNG")) returned 0 [0032.031] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.031] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png")) returned 1 [0032.032] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBo1lFJ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbo1lfj[2].png")) returned 0xffffffff [0032.032] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x455f5430, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x455f5430, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455f5430, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBs47TE[1].png", cAlternateFileName="BBS47T~1.PNG")) returned 1 [0032.032] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png")) returned 0x2020 [0032.032] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.032] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.033] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x23f, lpOverlapped=0x0) returned 1 [0032.034] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x23f, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x23f, lpOverlapped=0x0) returned 1 [0032.035] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.035] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.035] CloseHandle (hObject=0x114) returned 1 [0032.035] CloseHandle (hObject=0x100) returned 1 [0032.036] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png.crypt")) returned 0 [0032.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png.crypt")) returned 0x2020 [0032.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x455f5430, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x455f5430, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455f5430, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBs47TE[1].png", cAlternateFileName="BBS47T~1.PNG")) returned 0x5c9000 [0032.036] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x455f5430, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x455f5430, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x455f5430, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBs47TE[1].png", cAlternateFileName="BBS47T~1.PNG")) returned 0 [0032.037] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.037] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png")) returned 1 [0032.038] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBs47TE[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbs47te[1].png")) returned 0xffffffff [0032.038] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2cb0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBu9sWQ[1].jpg", cAlternateFileName="BBU9SW~1.JPG")) returned 1 [0032.038] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg")) returned 0x2020 [0032.038] VirtualAlloc (lpAddress=0x1f68000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f68000 [0032.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.039] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.041] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.044] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.044] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.044] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xcb0, lpOverlapped=0x0) returned 1 [0032.044] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xcb0, lpOverlapped=0x0) returned 1 [0032.044] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.044] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.044] CloseHandle (hObject=0x100) returned 1 [0032.045] CloseHandle (hObject=0x114) returned 1 [0032.045] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg.crypt")) returned 0 [0032.046] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg.crypt")) returned 0x2020 [0032.046] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2cb0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBu9sWQ[1].jpg", cAlternateFileName="BBU9SW~1.JPG")) returned 0x5c9000 [0032.046] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2cb0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBu9sWQ[1].jpg", cAlternateFileName="BBU9SW~1.JPG")) returned 0 [0032.046] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.046] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg")) returned 1 [0032.047] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BBu9sWQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbu9swq[1].jpg")) returned 0xffffffff [0032.047] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BByazif[2].jpg", cAlternateFileName="BBYAZI~2.JPG")) returned 1 [0032.047] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg")) returned 0x2020 [0032.047] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.047] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.048] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.050] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.050] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.051] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.052] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x28c, lpOverlapped=0x0) returned 1 [0032.052] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x28c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x28c, lpOverlapped=0x0) returned 1 [0032.052] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.052] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.052] CloseHandle (hObject=0x114) returned 1 [0032.052] CloseHandle (hObject=0x100) returned 1 [0032.053] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg.crypt")) returned 0 [0032.053] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg.crypt")) returned 0x2020 [0032.053] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BByazif[2].jpg", cAlternateFileName="BBYAZI~2.JPG")) returned 0x5c9000 [0032.053] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45bc29d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45bc29d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45bc29d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BByazif[2].jpg", cAlternateFileName="BBYAZI~2.JPG")) returned 0 [0032.053] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.053] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg")) returned 1 [0032.054] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\BByazif[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\bbyazif[2].jpg")) returned 0xffffffff [0032.054] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf13, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="bs-components[1].css", cAlternateFileName="BS-COM~1.CSS")) returned 1 [0032.054] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30be, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="bs-util[1].css", cAlternateFileName="BS-UTI~1.CSS")) returned 1 [0032.054] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd97bf10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbd97bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbd9a2070, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x254f1, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="c7-bdbd0d-91cdfbc1[1].txt", cAlternateFileName="C7-BDB~1.TXT")) returned 1 [0032.054] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt")) returned 0x2020 [0032.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.055] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.058] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.059] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.059] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.060] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.060] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.060] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.060] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.060] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.061] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.061] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.061] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.061] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.061] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.061] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.061] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.062] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.062] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.062] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.062] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.062] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.062] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.062] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.063] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.063] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.063] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.063] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.063] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.063] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.064] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.064] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.064] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.064] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.064] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.064] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.064] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.065] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.065] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.065] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.065] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.065] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.065] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.066] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.066] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.066] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.066] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.066] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.066] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.067] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.067] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.067] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.067] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.067] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.067] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.068] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.068] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.068] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.068] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.068] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.068] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.068] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.069] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.069] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.069] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.069] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.069] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.069] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.070] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.070] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.070] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.070] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.070] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.070] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.070] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.071] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x4f1, lpOverlapped=0x0) returned 1 [0032.071] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x4f1, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x4f1, lpOverlapped=0x0) returned 1 [0032.071] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.071] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.071] CloseHandle (hObject=0x100) returned 1 [0032.071] CloseHandle (hObject=0x114) returned 1 [0032.073] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt.crypt")) returned 0 [0032.073] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt.crypt")) returned 0x2020 [0032.073] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd97bf10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbd97bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbd9a2070, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x254f1, dwReserved0=0x5d6fc8, dwReserved1=0x18e59c, cFileName="c7-bdbd0d-91cdfbc1[1].txt", cAlternateFileName="C7-BDB~1.TXT")) returned 0x5c9000 [0032.073] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd97bf10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbd97bf10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbd9a2070, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x254f1, dwReserved0=0x5d6fc8, dwReserved1=0x18e59c, cFileName="c7-bdbd0d-91cdfbc1[1].txt", cAlternateFileName="C7-BDB~1.TXT")) returned 0 [0032.073] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.073] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt")) returned 1 [0032.075] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\c7-bdbd0d-91cdfbc1[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\c7-bdbd0d-91cdfbc1[1].txt")) returned 0xffffffff [0032.075] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x614e4380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x614e4380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x614e4380, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x211dd, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0032.075] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63c04d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c04d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63c04d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x653e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="cb=gapi[2].loaded_0", cAlternateFileName="CB_GAP~2.LOA")) returned 1 [0032.075] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x584c4b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x584c4b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58510e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a03f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="chrome.min[1].css", cAlternateFileName="CHROME~1.CSS")) returned 1 [0032.075] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c69520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c69520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c69520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="chrome_throbber_fast_16[1].gif", cAlternateFileName="CHROME~1.GIF")) returned 1 [0032.075] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55333bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55333bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1 [0032.075] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8f4e10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8f4e10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8f4e10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 1 [0032.075] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0032.075] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini")) returned 0x2006 [0032.076] VirtualAlloc (lpAddress=0x1f6c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f6c000 [0032.076] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.076] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.077] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x43, lpOverlapped=0x0) returned 1 [0032.078] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x43, lpOverlapped=0x0) returned 1 [0032.078] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.078] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.078] CloseHandle (hObject=0x114) returned 1 [0032.079] CloseHandle (hObject=0x100) returned 1 [0032.079] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini.crypt")) returned 0 [0032.079] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini.crypt")) returned 0x2020 [0032.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0032.079] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0032.079] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.079] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini")) returned 1 [0032.080] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\desktop.ini")) returned 0xffffffff [0032.080] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d9a020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d9a020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60de62e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48ba, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="eula-mac[1].jpg", cAlternateFileName="EULA-M~1.JPG")) returned 1 [0032.080] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg")) returned 0x2020 [0032.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.081] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.083] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.085] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.085] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.085] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.085] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.085] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.085] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.086] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x8ba, lpOverlapped=0x0) returned 1 [0032.086] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x8ba, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x8ba, lpOverlapped=0x0) returned 1 [0032.086] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.086] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.086] CloseHandle (hObject=0x100) returned 1 [0032.086] CloseHandle (hObject=0x114) returned 1 [0032.087] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg.crypt")) returned 0 [0032.088] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg.crypt")) returned 0x2020 [0032.088] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d9a020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d9a020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60de62e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48ba, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="eula-mac[1].jpg", cAlternateFileName="EULA-M~1.JPG")) returned 0x5c9000 [0032.088] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60d9a020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60d9a020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60de62e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48ba, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="eula-mac[1].jpg", cAlternateFileName="EULA-M~1.JPG")) returned 0 [0032.088] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.088] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg")) returned 1 [0032.089] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\eula-mac[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\eula-mac[1].jpg")) returned 0xffffffff [0032.089] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa84a, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="ga[1].js", cAlternateFileName="GA_1_~1.JS")) returned 1 [0032.089] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe1f6d70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1305, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~1")) returned 1 [0032.091] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x659c6020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x659c6020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65c99a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="GoogleInstaller_de[1].application", cAlternateFileName="GOOGLE~1.APP")) returned 1 [0032.091] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf03f170, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf03f170, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf0652d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4c9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0032.091] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2544b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2544b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2544b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1 [0032.091] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54feddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54feddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x550601d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7a43, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0032.091] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d1a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a114, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="MemMDL2.2.17[1].eot", cAlternateFileName="MEMMDL~1.EOT")) returned 1 [0032.092] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605b7740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605b7740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605b7740, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46c9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="modernizr[1].js", cAlternateFileName="MODERN~1.JS")) returned 1 [0032.092] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="MSNIdSync[1].js", cAlternateFileName="MSNIDS~1.JS")) returned 1 [0032.092] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 1 [0032.092] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6b6d, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="player[1].js", cAlternateFileName="PLAYER~1.JS")) returned 1 [0032.092] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5f44, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="player[2].js", cAlternateFileName="PLAYER~2.JS")) returned 1 [0032.092] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfb41730, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfb41730, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfb41730, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 1 [0032.092] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png")) returned 0x2020 [0032.093] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.093] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.093] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x67, lpOverlapped=0x0) returned 1 [0032.094] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x67, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x67, lpOverlapped=0x0) returned 1 [0032.095] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.095] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.095] CloseHandle (hObject=0x114) returned 1 [0032.095] CloseHandle (hObject=0x100) returned 1 [0032.096] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png.crypt")) returned 0 [0032.096] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png.crypt")) returned 0x2020 [0032.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfb41730, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfb41730, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfb41730, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 0x5c9000 [0032.096] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfb41730, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfb41730, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfb41730, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="tecjslog[1].png", cAlternateFileName="TECJSL~1.PNG")) returned 0 [0032.096] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.096] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png")) returned 1 [0032.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\tecjslog[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\tecjslog[1].png")) returned 0xffffffff [0032.097] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x692027e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x692027e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69232580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="thankyou[1].htm", cAlternateFileName="THANKY~1.HTM")) returned 1 [0032.097] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 1 [0032.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg")) returned 0x2020 [0032.097] VirtualAlloc (lpAddress=0x1f70000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f70000 [0032.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.099] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x911, lpOverlapped=0x0) returned 1 [0032.100] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x911, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x911, lpOverlapped=0x0) returned 1 [0032.101] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.101] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.101] CloseHandle (hObject=0x100) returned 1 [0032.101] CloseHandle (hObject=0x114) returned 1 [0032.102] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg.crypt")) returned 0 [0032.102] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg.crypt")) returned 0x2020 [0032.102] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x5d6fa8, dwReserved1=0x18e59c, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 0x5c9000 [0032.102] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x5d6fa8, dwReserved1=0x18e59c, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 0 [0032.102] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.103] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg")) returned 1 [0032.103] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\th[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\th[1].jpg")) returned 0xffffffff [0032.103] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c14b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55c14b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55c14b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="th[1].jpg", cAlternateFileName="TH_1_~1.JPG")) returned 0 [0032.103] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.104] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x6d74682e, dwReserved1=0x746f652e, cFileName="index.dat", cAlternateFileName="")) returned 1 [0032.104] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d74682e, dwReserved1=0x746f652e, cFileName="YG1R61Z8", cAlternateFileName="")) returned 1 [0032.104] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.106] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="..", cAlternateFileName="")) returned 1 [0032.108] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", cAlternateFileName="0FF929~1.JPG")) returned 1 [0032.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg")) returned 0x2020 [0032.108] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.109] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.111] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.112] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.112] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.112] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.113] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.113] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.113] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.113] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.113] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.114] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.114] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.114] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.114] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.114] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xf7e, lpOverlapped=0x0) returned 1 [0032.114] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xf7e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xf7e, lpOverlapped=0x0) returned 1 [0032.115] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.115] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.115] CloseHandle (hObject=0x114) returned 1 [0032.115] CloseHandle (hObject=0x100) returned 1 [0032.116] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.crypt")) returned 0 [0032.116] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.crypt")) returned 0x2020 [0032.116] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0x5d6ff0, dwReserved1=0x18e59c, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", cAlternateFileName="0FF929~1.JPG")) returned 0x5c9000 [0032.116] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0x5d6ff0, dwReserved1=0x18e59c, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg", cAlternateFileName="0FF929~1.JPG")) returned 0 [0032.116] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.116] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg")) returned 1 [0032.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg")) returned 0xffffffff [0032.117] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54a46970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="26158[1].png", cAlternateFileName="26158_~1.PNG")) returned 1 [0032.118] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png")) returned 0x2020 [0032.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.119] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.121] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.122] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.122] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.122] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.122] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.122] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.123] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.123] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.123] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.123] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.123] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.123] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.123] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.124] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.124] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.124] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.124] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.124] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.124] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.124] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.125] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.125] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.125] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.125] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x5f, lpOverlapped=0x0) returned 1 [0032.125] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x5f, lpOverlapped=0x0) returned 1 [0032.125] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.125] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.125] CloseHandle (hObject=0x100) returned 1 [0032.125] CloseHandle (hObject=0x114) returned 1 [0032.127] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png.crypt")) returned 0 [0032.127] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png.crypt")) returned 0x2020 [0032.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54a46970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="26158[1].png", cAlternateFileName="26158_~1.PNG")) returned 0x5c9000 [0032.127] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54a46970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="26158[1].png", cAlternateFileName="26158_~1.PNG")) returned 0 [0032.127] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.127] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png")) returned 1 [0032.128] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\26158[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\26158[1].png")) returned 0xffffffff [0032.128] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA42x3V[1].png", cAlternateFileName="AA42X3~1.PNG")) returned 1 [0032.128] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png")) returned 0x2020 [0032.129] VirtualAlloc (lpAddress=0x1f74000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f74000 [0032.129] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.130] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.130] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x3e3, lpOverlapped=0x0) returned 1 [0032.131] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x3e3, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x3e3, lpOverlapped=0x0) returned 1 [0032.132] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.132] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.132] CloseHandle (hObject=0x114) returned 1 [0032.132] CloseHandle (hObject=0x100) returned 1 [0032.133] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png.crypt")) returned 0 [0032.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png.crypt")) returned 0x2020 [0032.133] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA42x3V[1].png", cAlternateFileName="AA42X3~1.PNG")) returned 0x5c9000 [0032.133] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458eefb0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458eefb0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458eefb0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA42x3V[1].png", cAlternateFileName="AA42X3~1.PNG")) returned 0 [0032.133] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.134] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png")) returned 1 [0032.134] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA42x3V[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa42x3v[1].png")) returned 0xffffffff [0032.134] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5341bc90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5341bc90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA58NQj[1].png", cAlternateFileName="AA58NQ~1.PNG")) returned 1 [0032.135] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png")) returned 0x2020 [0032.135] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.135] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.135] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1d0, lpOverlapped=0x0) returned 1 [0032.137] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1d0, lpOverlapped=0x0) returned 1 [0032.138] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.138] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.138] CloseHandle (hObject=0x100) returned 1 [0032.138] CloseHandle (hObject=0x114) returned 1 [0032.138] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png.crypt")) returned 0 [0032.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png.crypt")) returned 0x2020 [0032.139] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5341bc90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5341bc90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA58NQj[1].png", cAlternateFileName="AA58NQ~1.PNG")) returned 0x5c9000 [0032.139] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5341bc90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5341bc90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA58NQj[1].png", cAlternateFileName="AA58NQ~1.PNG")) returned 0 [0032.139] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.139] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png")) returned 1 [0032.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA58NQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa58nqj[1].png")) returned 0xffffffff [0032.140] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA61Ofl[1].png", cAlternateFileName="AA61OF~1.PNG")) returned 1 [0032.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png")) returned 0x2020 [0032.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.141] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1c4, lpOverlapped=0x0) returned 1 [0032.142] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1c4, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1c4, lpOverlapped=0x0) returned 1 [0032.143] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.143] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.143] CloseHandle (hObject=0x114) returned 1 [0032.143] CloseHandle (hObject=0x100) returned 1 [0032.144] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png.crypt")) returned 0 [0032.144] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png.crypt")) returned 0x2020 [0032.144] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA61Ofl[1].png", cAlternateFileName="AA61OF~1.PNG")) returned 0x5c9000 [0032.145] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x515e8570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x515e8570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x515e8570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA61Ofl[1].png", cAlternateFileName="AA61OF~1.PNG")) returned 0 [0032.145] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.145] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png")) returned 1 [0032.146] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA61Ofl[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa61ofl[1].png")) returned 0xffffffff [0032.146] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AA6SFRQ[2].png", cAlternateFileName="AA6SFR~2.PNG")) returned 1 [0032.146] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png")) returned 0x2020 [0032.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.147] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2ed, lpOverlapped=0x0) returned 1 [0032.148] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2ed, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2ed, lpOverlapped=0x0) returned 1 [0032.149] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.149] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.149] CloseHandle (hObject=0x100) returned 1 [0032.149] CloseHandle (hObject=0x114) returned 1 [0032.149] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png.crypt")) returned 0 [0032.149] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png.crypt")) returned 0x2020 [0032.150] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA6SFRQ[2].png", cAlternateFileName="AA6SFR~2.PNG")) returned 0x5c9000 [0032.150] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AA6SFRQ[2].png", cAlternateFileName="AA6SFR~2.PNG")) returned 0 [0032.150] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.150] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png")) returned 1 [0032.151] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AA6SFRQ[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aa6sfrq[2].png")) returned 0xffffffff [0032.151] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAa1vhm[1].png", cAlternateFileName="AAA1VH~1.PNG")) returned 1 [0032.151] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png")) returned 0x2020 [0032.152] VirtualAlloc (lpAddress=0x1f78000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f78000 [0032.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.153] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x19e, lpOverlapped=0x0) returned 1 [0032.157] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x19e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x19e, lpOverlapped=0x0) returned 1 [0032.158] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.158] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.158] CloseHandle (hObject=0x114) returned 1 [0032.158] CloseHandle (hObject=0x100) returned 1 [0032.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png.crypt")) returned 0 [0032.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png.crypt")) returned 0x2020 [0032.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAa1vhm[1].png", cAlternateFileName="AAA1VH~1.PNG")) returned 0x5c9000 [0032.159] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4580a770, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4580a770, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4580a770, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAa1vhm[1].png", cAlternateFileName="AAA1VH~1.PNG")) returned 0 [0032.159] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.159] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png")) returned 1 [0032.160] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1vhm[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1vhm[1].png")) returned 0xffffffff [0032.160] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAa1xJF[1].png", cAlternateFileName="AAA1XJ~1.PNG")) returned 1 [0032.160] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png")) returned 0x2020 [0032.160] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.161] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.161] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2c1, lpOverlapped=0x0) returned 1 [0032.162] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2c1, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2c1, lpOverlapped=0x0) returned 1 [0032.163] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.163] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.163] CloseHandle (hObject=0x100) returned 1 [0032.163] CloseHandle (hObject=0x114) returned 1 [0032.164] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png.crypt")) returned 0 [0032.164] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png.crypt")) returned 0x2020 [0032.164] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAa1xJF[1].png", cAlternateFileName="AAA1XJ~1.PNG")) returned 0x5c9000 [0032.164] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAa1xJF[1].png", cAlternateFileName="AAA1XJ~1.PNG")) returned 0 [0032.165] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.165] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png")) returned 1 [0032.165] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAa1xJF[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aaa1xjf[1].png")) returned 0xffffffff [0032.166] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAlG41q[1].jpg", cAlternateFileName="AALG41~1.JPG")) returned 1 [0032.166] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg")) returned 0x2020 [0032.166] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.166] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.166] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7b8, lpOverlapped=0x0) returned 1 [0032.168] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7b8, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7b8, lpOverlapped=0x0) returned 1 [0032.168] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.169] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.169] CloseHandle (hObject=0x114) returned 1 [0032.169] CloseHandle (hObject=0x100) returned 1 [0032.169] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg.crypt")) returned 0 [0032.169] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg.crypt")) returned 0x2020 [0032.170] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAlG41q[1].jpg", cAlternateFileName="AALG41~1.JPG")) returned 0x5c9000 [0032.170] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5159c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5159c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5159c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAlG41q[1].jpg", cAlternateFileName="AALG41~1.JPG")) returned 0 [0032.170] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.170] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg")) returned 1 [0032.171] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAlG41q[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aalg41q[1].jpg")) returned 0xffffffff [0032.171] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAmin0Z[1].png", cAlternateFileName="AAMIN0~1.PNG")) returned 1 [0032.171] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png")) returned 0x2020 [0032.171] VirtualAlloc (lpAddress=0x1f7c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f7c000 [0032.171] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.171] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.172] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x157, lpOverlapped=0x0) returned 1 [0032.173] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x157, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x157, lpOverlapped=0x0) returned 1 [0032.174] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.174] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.174] CloseHandle (hObject=0x100) returned 1 [0032.174] CloseHandle (hObject=0x114) returned 1 [0032.175] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png.crypt")) returned 0 [0032.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png.crypt")) returned 0x2020 [0032.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAmin0Z[1].png", cAlternateFileName="AAMIN0~1.PNG")) returned 0x5c9000 [0032.175] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAmin0Z[1].png", cAlternateFileName="AAMIN0~1.PNG")) returned 0 [0032.175] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.175] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png")) returned 1 [0032.176] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAmin0Z[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aamin0z[1].png")) returned 0xffffffff [0032.176] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533f5b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533f5b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b1, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="AAnhRyj[1].jpg", cAlternateFileName="AANHRY~1.JPG")) returned 1 [0032.176] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg")) returned 0x2020 [0032.177] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.177] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.177] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.179] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.180] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.180] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.180] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.181] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.181] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x6b1, lpOverlapped=0x0) returned 1 [0032.181] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x6b1, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x6b1, lpOverlapped=0x0) returned 1 [0032.181] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.181] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.181] CloseHandle (hObject=0x114) returned 1 [0032.181] CloseHandle (hObject=0x100) returned 1 [0032.182] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg.crypt")) returned 0 [0032.182] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg.crypt")) returned 0x2020 [0032.182] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533f5b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533f5b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b1, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAnhRyj[1].jpg", cAlternateFileName="AANHRY~1.JPG")) returned 0x5c9000 [0032.182] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533f5b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533f5b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5341bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b1, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="AAnhRyj[1].jpg", cAlternateFileName="AANHRY~1.JPG")) returned 0 [0032.182] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.182] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg")) returned 1 [0032.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\AAnhRyj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\aanhryj[1].jpg")) returned 0xffffffff [0032.183] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c161a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64c161a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e9d900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1 [0032.183] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2eca30, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2eca30, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x91dd, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="adex[1].js", cAlternateFileName="ADEX_1~1.JS")) returned 1 [0032.183] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x540e72d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540e72d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x540e72d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1 [0032.183] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdb6b0f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdb6b0f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdb6b0f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x525b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="adsWrapperMSNI[1].js", cAlternateFileName="ADSWRA~1.JS")) returned 1 [0032.183] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8217, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", cAlternateFileName="AE8E98~1.JPG")) returned 1 [0032.183] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg")) returned 0x2020 [0032.184] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.185] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.187] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.188] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.188] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.188] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.188] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.188] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.189] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.189] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.189] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.189] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.189] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.189] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.190] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.190] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.190] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.190] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x217, lpOverlapped=0x0) returned 1 [0032.190] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x217, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x217, lpOverlapped=0x0) returned 1 [0032.190] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.190] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.190] CloseHandle (hObject=0x100) returned 1 [0032.190] CloseHandle (hObject=0x114) returned 1 [0032.191] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.crypt")) returned 0 [0032.192] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.crypt")) returned 0x2020 [0032.192] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8217, dwReserved0=0x5d6ff0, dwReserved1=0x18e59c, cFileName="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", cAlternateFileName="AE8E98~1.JPG")) returned 0x5c9000 [0032.192] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe967230, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe967230, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8217, dwReserved0=0x5d6ff0, dwReserved1=0x18e59c, cFileName="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg", cAlternateFileName="AE8E98~1.JPG")) returned 0 [0032.192] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.192] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg")) returned 1 [0032.193] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg")) returned 0xffffffff [0032.193] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe112530, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe112530, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1183b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="ast[1].js", cAlternateFileName="AST_1_~1.JS")) returned 1 [0032.193] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58798580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58798580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58798580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="autotrack[1].js", cAlternateFileName="AUTOTR~1.JS")) returned 1 [0032.193] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BB56XTo[1].png", cAlternateFileName="BB56XT~1.PNG")) returned 1 [0032.193] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png")) returned 0x2020 [0032.194] VirtualAlloc (lpAddress=0x1f80000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f80000 [0032.194] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.194] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.194] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x145, lpOverlapped=0x0) returned 1 [0032.196] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x145, lpOverlapped=0x0) returned 1 [0032.197] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.197] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.197] CloseHandle (hObject=0x114) returned 1 [0032.197] CloseHandle (hObject=0x100) returned 1 [0032.197] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png.crypt")) returned 0 [0032.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png.crypt")) returned 0x2020 [0032.198] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB56XTo[1].png", cAlternateFileName="BB56XT~1.PNG")) returned 0x5c9000 [0032.198] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45987530, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45987530, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB56XTo[1].png", cAlternateFileName="BB56XT~1.PNG")) returned 0 [0032.198] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.198] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png")) returned 1 [0032.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB56XTo[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb56xto[1].png")) returned 0xffffffff [0032.199] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BB5vO0g[1].png", cAlternateFileName="BB5VO0~1.PNG")) returned 1 [0032.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png")) returned 0x2020 [0032.199] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.199] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.199] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1b6, lpOverlapped=0x0) returned 1 [0032.201] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1b6, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1b6, lpOverlapped=0x0) returned 1 [0032.202] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.202] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.202] CloseHandle (hObject=0x100) returned 1 [0032.202] CloseHandle (hObject=0x114) returned 1 [0032.202] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png.crypt")) returned 0 [0032.203] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png.crypt")) returned 0x2020 [0032.203] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB5vO0g[1].png", cAlternateFileName="BB5VO0~1.PNG")) returned 0x5c9000 [0032.203] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e28590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e28590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e28590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB5vO0g[1].png", cAlternateFileName="BB5VO0~1.PNG")) returned 0 [0032.203] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.203] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png")) returned 1 [0032.204] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB5vO0g[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb5vo0g[1].png")) returned 0xffffffff [0032.204] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BB8AdqN[1].png", cAlternateFileName="BB8ADQ~1.PNG")) returned 1 [0032.204] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png")) returned 0x2020 [0032.204] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.204] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.205] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x156, lpOverlapped=0x0) returned 1 [0032.206] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x156, lpOverlapped=0x0) returned 1 [0032.207] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.207] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.207] CloseHandle (hObject=0x114) returned 1 [0032.207] CloseHandle (hObject=0x100) returned 1 [0032.208] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png.crypt")) returned 0 [0032.208] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png.crypt")) returned 0x2020 [0032.208] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB8AdqN[1].png", cAlternateFileName="BB8ADQ~1.PNG")) returned 0x5c9000 [0032.208] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BB8AdqN[1].png", cAlternateFileName="BB8ADQ~1.PNG")) returned 0 [0032.208] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.209] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png")) returned 1 [0032.209] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BB8AdqN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bb8adqn[1].png")) returned 0xffffffff [0032.210] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45be8b30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45be8b30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ca7210, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x152c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBALZyp[1].jpg", cAlternateFileName="BBALZY~1.JPG")) returned 1 [0032.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg")) returned 0x2020 [0032.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.210] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.212] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.213] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x52c, lpOverlapped=0x0) returned 1 [0032.213] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x52c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x52c, lpOverlapped=0x0) returned 1 [0032.213] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.213] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.213] CloseHandle (hObject=0x100) returned 1 [0032.213] CloseHandle (hObject=0x114) returned 1 [0032.214] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg.crypt")) returned 0 [0032.214] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg.crypt")) returned 0x2020 [0032.214] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45be8b30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45be8b30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ca7210, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x152c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBALZyp[1].jpg", cAlternateFileName="BBALZY~1.JPG")) returned 0x5c9000 [0032.215] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45be8b30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45be8b30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ca7210, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x152c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBALZyp[1].jpg", cAlternateFileName="BBALZY~1.JPG")) returned 0 [0032.215] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.215] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg")) returned 1 [0032.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBALZyp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbalzyp[1].jpg")) returned 0xffffffff [0032.216] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5360ae70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5360ae70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5360ae70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBImKp[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 1 [0032.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg")) returned 0x2020 [0032.216] VirtualAlloc (lpAddress=0x1f84000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f84000 [0032.216] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.216] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.217] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x97c, lpOverlapped=0x0) returned 1 [0032.218] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x97c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x97c, lpOverlapped=0x0) returned 1 [0032.219] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.219] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.219] CloseHandle (hObject=0x114) returned 1 [0032.219] CloseHandle (hObject=0x100) returned 1 [0032.220] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg.crypt")) returned 0 [0032.220] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg.crypt")) returned 0x2020 [0032.220] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5360ae70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5360ae70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5360ae70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBImKp[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 0x5c9000 [0032.220] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5360ae70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5360ae70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5360ae70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBImKp[1].jpg", cAlternateFileName="BBBIMK~1.JPG")) returned 0 [0032.220] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.220] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg")) returned 1 [0032.221] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBImKp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbimkp[1].jpg")) returned 0xffffffff [0032.221] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53630fd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ca, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBMGJo[1].jpg", cAlternateFileName="BBBMGJ~1.JPG")) returned 1 [0032.221] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg")) returned 0x2020 [0032.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.222] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.224] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.225] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.225] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.225] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9ca, lpOverlapped=0x0) returned 1 [0032.225] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9ca, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9ca, lpOverlapped=0x0) returned 1 [0032.226] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.226] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.226] CloseHandle (hObject=0x100) returned 1 [0032.226] CloseHandle (hObject=0x114) returned 1 [0032.226] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg.crypt")) returned 0 [0032.227] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg.crypt")) returned 0x2020 [0032.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53630fd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ca, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBMGJo[1].jpg", cAlternateFileName="BBBMGJ~1.JPG")) returned 0x5c9000 [0032.227] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53598a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53598a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53630fd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29ca, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBMGJo[1].jpg", cAlternateFileName="BBBMGJ~1.JPG")) returned 0 [0032.227] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.227] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg")) returned 1 [0032.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMGJo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmgjo[1].jpg")) returned 0xffffffff [0032.228] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x862, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBMKDF[1].jpg", cAlternateFileName="BBBMKD~1.JPG")) returned 1 [0032.228] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg")) returned 0x2020 [0032.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.229] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x862, lpOverlapped=0x0) returned 1 [0032.230] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x862, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x862, lpOverlapped=0x0) returned 1 [0032.231] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.231] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.231] CloseHandle (hObject=0x114) returned 1 [0032.231] CloseHandle (hObject=0x100) returned 1 [0032.232] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg.crypt")) returned 0 [0032.232] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg.crypt")) returned 0x2020 [0032.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x862, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBMKDF[1].jpg", cAlternateFileName="BBBMKD~1.JPG")) returned 0x5c9000 [0032.232] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539049f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539049f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539049f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x862, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBMKDF[1].jpg", cAlternateFileName="BBBMKD~1.JPG")) returned 0 [0032.232] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.233] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg")) returned 1 [0032.233] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMKDF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmkdf[1].jpg")) returned 0xffffffff [0032.233] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBMQch[1].jpg", cAlternateFileName="BBBMQC~1.JPG")) returned 1 [0032.234] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg")) returned 0x2020 [0032.234] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.234] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.234] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.236] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.237] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x42e, lpOverlapped=0x0) returned 1 [0032.237] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x42e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x42e, lpOverlapped=0x0) returned 1 [0032.237] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.237] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.237] CloseHandle (hObject=0x100) returned 1 [0032.237] CloseHandle (hObject=0x114) returned 1 [0032.238] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg.crypt")) returned 0 [0032.238] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg.crypt")) returned 0x2020 [0032.239] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBMQch[1].jpg", cAlternateFileName="BBBMQC~1.JPG")) returned 0x5c9000 [0032.239] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53846310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53846310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53846310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBMQch[1].jpg", cAlternateFileName="BBBMQC~1.JPG")) returned 0 [0032.239] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.239] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg")) returned 1 [0032.240] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMQch[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmqch[1].jpg")) returned 0xffffffff [0032.240] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58321c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58321c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58321c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e6b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBMyVh[1].jpg", cAlternateFileName="BBBMYV~1.JPG")) returned 1 [0032.240] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg")) returned 0x2020 [0032.241] VirtualAlloc (lpAddress=0x1f88000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f88000 [0032.241] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.241] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.241] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.243] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.244] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.244] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.245] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.245] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.245] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xe6b, lpOverlapped=0x0) returned 1 [0032.245] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xe6b, lpOverlapped=0x0) returned 1 [0032.245] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.245] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.245] CloseHandle (hObject=0x114) returned 1 [0032.245] CloseHandle (hObject=0x100) returned 1 [0032.246] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg.crypt")) returned 0 [0032.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg.crypt")) returned 0x2020 [0032.247] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58321c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58321c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58321c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e6b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBMyVh[1].jpg", cAlternateFileName="BBBMYV~1.JPG")) returned 0x5c9000 [0032.247] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58321c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58321c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58321c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e6b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBMyVh[1].jpg", cAlternateFileName="BBBMYV~1.JPG")) returned 0 [0032.247] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.247] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg")) returned 1 [0032.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBMyVh[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbmyvh[1].jpg")) returned 0xffffffff [0032.248] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBNAf7[1].jpg", cAlternateFileName="BBBNAF~1.JPG")) returned 1 [0032.248] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg")) returned 0x2020 [0032.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.249] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x812, lpOverlapped=0x0) returned 1 [0032.250] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x812, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x812, lpOverlapped=0x0) returned 1 [0032.251] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.251] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.251] CloseHandle (hObject=0x100) returned 1 [0032.251] CloseHandle (hObject=0x114) returned 1 [0032.252] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg.crypt")) returned 0 [0032.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg.crypt")) returned 0x2020 [0032.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBNAf7[1].jpg", cAlternateFileName="BBBNAF~1.JPG")) returned 0x5c9000 [0032.252] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53337450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53337450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53337450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBNAf7[1].jpg", cAlternateFileName="BBBNAF~1.JPG")) returned 0 [0032.252] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.252] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg")) returned 1 [0032.253] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNAf7[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnaf7[1].jpg")) returned 0xffffffff [0032.253] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBNnTF[1].jpg", cAlternateFileName="BBBNNT~1.JPG")) returned 1 [0032.253] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg")) returned 0x2020 [0032.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.254] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.255] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xb22, lpOverlapped=0x0) returned 1 [0032.256] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xb22, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xb22, lpOverlapped=0x0) returned 1 [0032.257] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.257] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.257] CloseHandle (hObject=0x114) returned 1 [0032.258] CloseHandle (hObject=0x100) returned 1 [0032.258] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg.crypt")) returned 0 [0032.258] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg.crypt")) returned 0x2020 [0032.259] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBNnTF[1].jpg", cAlternateFileName="BBBNNT~1.JPG")) returned 0x5c9000 [0032.259] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBNnTF[1].jpg", cAlternateFileName="BBBNNT~1.JPG")) returned 0 [0032.259] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.259] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg")) returned 1 [0032.260] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBNnTF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbnntf[1].jpg")) returned 0xffffffff [0032.260] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539c30d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539c30d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1529, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBO4dZ[1].jpg", cAlternateFileName="BBBO4D~1.JPG")) returned 1 [0032.261] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg")) returned 0x2020 [0032.261] VirtualAlloc (lpAddress=0x1f8c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f8c000 [0032.261] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.262] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.262] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.264] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.265] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x529, lpOverlapped=0x0) returned 1 [0032.265] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x529, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x529, lpOverlapped=0x0) returned 1 [0032.265] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.265] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.265] CloseHandle (hObject=0x100) returned 1 [0032.265] CloseHandle (hObject=0x114) returned 1 [0032.266] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg.crypt")) returned 0 [0032.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg.crypt")) returned 0x2020 [0032.266] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539c30d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539c30d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1529, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO4dZ[1].jpg", cAlternateFileName="BBBO4D~1.JPG")) returned 0x5c9000 [0032.266] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x539c30d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x539c30d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x539c30d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1529, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO4dZ[1].jpg", cAlternateFileName="BBBO4D~1.JPG")) returned 0 [0032.266] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.267] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg")) returned 1 [0032.267] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO4dZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo4dz[1].jpg")) returned 0xffffffff [0032.267] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e61, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBO8ow[1].jpg", cAlternateFileName="BBBO8O~1.JPG")) returned 1 [0032.267] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg")) returned 0x2020 [0032.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.268] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.270] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.271] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xe61, lpOverlapped=0x0) returned 1 [0032.271] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xe61, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xe61, lpOverlapped=0x0) returned 1 [0032.271] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.271] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.271] CloseHandle (hObject=0x114) returned 1 [0032.272] CloseHandle (hObject=0x100) returned 1 [0032.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg.crypt")) returned 0 [0032.273] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg.crypt")) returned 0x2020 [0032.273] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e61, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO8ow[1].jpg", cAlternateFileName="BBBO8O~1.JPG")) returned 0x5c9000 [0032.273] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x538b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x538b8730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x538b8730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1e61, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBO8ow[1].jpg", cAlternateFileName="BBBO8O~1.JPG")) returned 0 [0032.273] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.273] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg")) returned 1 [0032.274] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBO8ow[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbo8ow[1].jpg")) returned 0xffffffff [0032.274] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBOaeS[1].jpg", cAlternateFileName="BBBOAE~1.JPG")) returned 1 [0032.274] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg")) returned 0x2020 [0032.274] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.274] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.275] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x636, lpOverlapped=0x0) returned 1 [0032.276] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x636, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x636, lpOverlapped=0x0) returned 1 [0032.277] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.277] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.277] CloseHandle (hObject=0x100) returned 1 [0032.277] CloseHandle (hObject=0x114) returned 1 [0032.278] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg.crypt")) returned 0 [0032.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg.crypt")) returned 0x2020 [0032.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOaeS[1].jpg", cAlternateFileName="BBBOAE~1.JPG")) returned 0x5c9000 [0032.278] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x532eb190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x532eb190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x532eb190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOaeS[1].jpg", cAlternateFileName="BBBOAE~1.JPG")) returned 0 [0032.278] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.278] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg")) returned 1 [0032.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOaeS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboaes[1].jpg")) returned 0xffffffff [0032.279] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53278d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53278d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53278d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBOcIb[1].jpg", cAlternateFileName="BBBOCI~1.JPG")) returned 1 [0032.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg")) returned 0x2020 [0032.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.280] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x82a, lpOverlapped=0x0) returned 1 [0032.281] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x82a, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x82a, lpOverlapped=0x0) returned 1 [0032.282] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.282] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.282] CloseHandle (hObject=0x114) returned 1 [0032.282] CloseHandle (hObject=0x100) returned 1 [0032.283] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg.crypt")) returned 0 [0032.283] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg.crypt")) returned 0x2020 [0032.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53278d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53278d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53278d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOcIb[1].jpg", cAlternateFileName="BBBOCI~1.JPG")) returned 0x5c9000 [0032.283] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53278d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53278d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53278d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOcIb[1].jpg", cAlternateFileName="BBBOCI~1.JPG")) returned 0 [0032.283] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.283] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg")) returned 1 [0032.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOcIb[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbocib[1].jpg")) returned 0xffffffff [0032.284] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBOddp[1].jpg", cAlternateFileName="BBBODD~1.JPG")) returned 1 [0032.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg")) returned 0x2020 [0032.286] VirtualAlloc (lpAddress=0x1f90000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f90000 [0032.286] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.287] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.289] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.290] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x61e, lpOverlapped=0x0) returned 1 [0032.290] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x61e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x61e, lpOverlapped=0x0) returned 1 [0032.290] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.290] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.290] CloseHandle (hObject=0x100) returned 1 [0032.290] CloseHandle (hObject=0x114) returned 1 [0032.291] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg.crypt")) returned 0 [0032.291] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg.crypt")) returned 0x2020 [0032.291] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOddp[1].jpg", cAlternateFileName="BBBODD~1.JPG")) returned 0x5c9000 [0032.292] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53b8c150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOddp[1].jpg", cAlternateFileName="BBBODD~1.JPG")) returned 0 [0032.292] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.292] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg")) returned 1 [0032.293] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOddp[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbboddp[1].jpg")) returned 0xffffffff [0032.293] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a1fd500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1fd500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a223660, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5685, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBOmar[1].jpg", cAlternateFileName="BBBOMA~1.JPG")) returned 1 [0032.293] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg")) returned 0x2020 [0032.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.294] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.296] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.297] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.297] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.297] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.298] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.298] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.298] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.298] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.298] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.298] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x685, lpOverlapped=0x0) returned 1 [0032.298] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x685, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x685, lpOverlapped=0x0) returned 1 [0032.299] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.299] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.299] CloseHandle (hObject=0x114) returned 1 [0032.299] CloseHandle (hObject=0x100) returned 1 [0032.300] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg.crypt")) returned 0 [0032.300] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg.crypt")) returned 0x2020 [0032.300] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a1fd500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1fd500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a223660, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5685, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOmar[1].jpg", cAlternateFileName="BBBOMA~1.JPG")) returned 0x5c9000 [0032.300] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a1fd500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a1fd500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a223660, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5685, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBOmar[1].jpg", cAlternateFileName="BBBOMA~1.JPG")) returned 0 [0032.300] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.300] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg")) returned 1 [0032.301] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBOmar[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbomar[1].jpg")) returned 0xffffffff [0032.301] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2f6b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBR4yQ[1].jpg", cAlternateFileName="BBBR4Y~1.JPG")) returned 1 [0032.301] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg")) returned 0x2020 [0032.302] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.302] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.303] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.304] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.305] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.306] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.306] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xf6b, lpOverlapped=0x0) returned 1 [0032.306] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xf6b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xf6b, lpOverlapped=0x0) returned 1 [0032.306] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.306] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.306] CloseHandle (hObject=0x100) returned 1 [0032.306] CloseHandle (hObject=0x114) returned 1 [0032.307] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg.crypt")) returned 0 [0032.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg.crypt")) returned 0x2020 [0032.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2f6b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBR4yQ[1].jpg", cAlternateFileName="BBBR4Y~1.JPG")) returned 0x5c9000 [0032.307] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f7f1f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f7f1f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f7f1f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2f6b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBR4yQ[1].jpg", cAlternateFileName="BBBR4Y~1.JPG")) returned 0 [0032.307] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.307] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg")) returned 1 [0032.308] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBR4yQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbr4yq[1].jpg")) returned 0xffffffff [0032.308] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBUPaj[1].jpg", cAlternateFileName="BBBUPA~1.JPG")) returned 1 [0032.308] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg")) returned 0x2020 [0032.309] VirtualAlloc (lpAddress=0x1f94000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f94000 [0032.309] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.309] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.310] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.311] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.312] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.313] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.313] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x64b, lpOverlapped=0x0) returned 1 [0032.313] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x64b, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x64b, lpOverlapped=0x0) returned 1 [0032.313] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.313] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.313] CloseHandle (hObject=0x114) returned 1 [0032.313] CloseHandle (hObject=0x100) returned 1 [0032.314] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg.crypt")) returned 0 [0032.314] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg.crypt")) returned 0x2020 [0032.314] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBUPaj[1].jpg", cAlternateFileName="BBBUPA~1.JPG")) returned 0x5c9000 [0032.314] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e4e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBUPaj[1].jpg", cAlternateFileName="BBBUPA~1.JPG")) returned 0 [0032.314] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.315] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg")) returned 1 [0032.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBUPaj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbupaj[1].jpg")) returned 0xffffffff [0032.316] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 1 [0032.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg")) returned 0x2020 [0032.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.317] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.319] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.319] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.320] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.320] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.320] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.320] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xe08, lpOverlapped=0x0) returned 1 [0032.320] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xe08, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xe08, lpOverlapped=0x0) returned 1 [0032.320] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.321] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.321] CloseHandle (hObject=0x100) returned 1 [0032.321] CloseHandle (hObject=0x114) returned 1 [0032.321] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg.crypt")) returned 0 [0032.322] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg.crypt")) returned 0x2020 [0032.322] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 0x5c9000 [0032.322] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e275160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5e275160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5e275160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVEOW[1].jpg", cAlternateFileName="BBBVEO~1.JPG")) returned 0 [0032.322] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.322] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg")) returned 1 [0032.325] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbveow[1].jpg")) returned 0xffffffff [0032.325] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa1f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBVLcG[1].jpg", cAlternateFileName="BBBVLC~1.JPG")) returned 1 [0032.325] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg")) returned 0x2020 [0032.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.326] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xa1f, lpOverlapped=0x0) returned 1 [0032.327] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xa1f, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xa1f, lpOverlapped=0x0) returned 1 [0032.328] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.328] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.328] CloseHandle (hObject=0x114) returned 1 [0032.328] CloseHandle (hObject=0x100) returned 1 [0032.329] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg.crypt")) returned 0 [0032.329] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg.crypt")) returned 0x2020 [0032.329] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa1f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVLcG[1].jpg", cAlternateFileName="BBBVLC~1.JPG")) returned 0x5c9000 [0032.329] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f32f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f32f30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f32f30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa1f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVLcG[1].jpg", cAlternateFileName="BBBVLC~1.JPG")) returned 0 [0032.329] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.330] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg")) returned 1 [0032.330] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVLcG[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvlcg[1].jpg")) returned 0xffffffff [0032.331] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82d, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBVSkP[1].jpg", cAlternateFileName="BBBVSK~1.JPG")) returned 1 [0032.331] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg")) returned 0x2020 [0032.331] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.331] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.331] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x82d, lpOverlapped=0x0) returned 1 [0032.333] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x82d, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x82d, lpOverlapped=0x0) returned 1 [0032.333] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.334] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.334] CloseHandle (hObject=0x100) returned 1 [0032.334] CloseHandle (hObject=0x114) returned 1 [0032.334] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg.crypt")) returned 0 [0032.335] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg.crypt")) returned 0x2020 [0032.335] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVSkP[1].jpg", cAlternateFileName="BBBVSK~1.JPG")) returned 0x5c9000 [0032.335] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBVSkP[1].jpg", cAlternateFileName="BBBVSK~1.JPG")) returned 0 [0032.335] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.335] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg")) returned 1 [0032.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBVSkP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbvskp[1].jpg")) returned 0xffffffff [0032.336] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x612a8ee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x612a8ee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x612a8ee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16f5, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 1 [0032.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg")) returned 0x2020 [0032.336] VirtualAlloc (lpAddress=0x1f98000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f98000 [0032.336] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.336] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.337] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.339] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.340] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x6f5, lpOverlapped=0x0) returned 1 [0032.340] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x6f5, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x6f5, lpOverlapped=0x0) returned 1 [0032.340] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.340] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.340] CloseHandle (hObject=0x114) returned 1 [0032.340] CloseHandle (hObject=0x100) returned 1 [0032.341] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg.crypt")) returned 0 [0032.341] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg.crypt")) returned 0x2020 [0032.341] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x612a8ee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x612a8ee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x612a8ee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16f5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 0x5c9000 [0032.341] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x612a8ee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x612a8ee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x612a8ee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x16f5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBYfEH[1].jpg", cAlternateFileName="BBBYFE~1.JPG")) returned 0 [0032.341] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.341] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg")) returned 1 [0032.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBYfEH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbyfeh[1].jpg")) returned 0xffffffff [0032.342] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBBZ5vT[1].jpg", cAlternateFileName="BBBZ5V~1.JPG")) returned 1 [0032.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg")) returned 0x2020 [0032.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.343] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xc20, lpOverlapped=0x0) returned 1 [0032.345] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xc20, lpOverlapped=0x0) returned 1 [0032.346] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.346] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.346] CloseHandle (hObject=0x100) returned 1 [0032.346] CloseHandle (hObject=0x114) returned 1 [0032.347] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg.crypt")) returned 0 [0032.347] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg.crypt")) returned 0x2020 [0032.347] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBZ5vT[1].jpg", cAlternateFileName="BBBZ5V~1.JPG")) returned 0x5c9000 [0032.348] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53017770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53017770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53017770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBBZ5vT[1].jpg", cAlternateFileName="BBBZ5V~1.JPG")) returned 0 [0032.348] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.348] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg")) returned 1 [0032.349] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBBZ5vT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbbz5vt[1].jpg")) returned 0xffffffff [0032.349] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC02Gr[1].jpg", cAlternateFileName="BBC02G~1.JPG")) returned 1 [0032.349] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg")) returned 0x2020 [0032.351] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.351] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.352] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x86e, lpOverlapped=0x0) returned 1 [0032.353] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x86e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x86e, lpOverlapped=0x0) returned 1 [0032.354] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.354] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.354] CloseHandle (hObject=0x114) returned 1 [0032.354] CloseHandle (hObject=0x100) returned 1 [0032.355] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg.crypt")) returned 0 [0032.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg.crypt")) returned 0x2020 [0032.355] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC02Gr[1].jpg", cAlternateFileName="BBC02G~1.JPG")) returned 0x5c9000 [0032.355] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x514ddbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x514ddbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x514ddbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC02Gr[1].jpg", cAlternateFileName="BBC02G~1.JPG")) returned 0 [0032.355] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.355] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg")) returned 1 [0032.356] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[1].jpg")) returned 0xffffffff [0032.356] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC02Gr[2].jpg", cAlternateFileName="BBC02G~2.JPG")) returned 1 [0032.356] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg")) returned 0x2020 [0032.357] VirtualAlloc (lpAddress=0x1f9c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f9c000 [0032.357] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.357] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.358] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x86e, lpOverlapped=0x0) returned 1 [0032.359] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x86e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x86e, lpOverlapped=0x0) returned 1 [0032.360] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.360] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.360] CloseHandle (hObject=0x100) returned 1 [0032.360] CloseHandle (hObject=0x114) returned 1 [0032.361] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg.crypt")) returned 0 [0032.361] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg.crypt")) returned 0x2020 [0032.361] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC02Gr[2].jpg", cAlternateFileName="BBC02G~2.JPG")) returned 0x5c9000 [0032.361] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5392ab50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5392ab50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5392ab50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC02Gr[2].jpg", cAlternateFileName="BBC02G~2.JPG")) returned 0 [0032.361] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.361] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg")) returned 1 [0032.362] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC02Gr[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc02gr[2].jpg")) returned 0xffffffff [0032.362] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x89a, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 1 [0032.362] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg")) returned 0x2020 [0032.363] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.363] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.364] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x89a, lpOverlapped=0x0) returned 1 [0032.365] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x89a, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x89a, lpOverlapped=0x0) returned 1 [0032.366] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.366] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.366] CloseHandle (hObject=0x114) returned 1 [0032.366] CloseHandle (hObject=0x100) returned 1 [0032.367] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg.crypt")) returned 0 [0032.367] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg.crypt")) returned 0x2020 [0032.367] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x89a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 0x5c9000 [0032.367] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fa5350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fa5350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fa5350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x89a, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC03B1[1].jpg", cAlternateFileName="BBC03B~1.JPG")) returned 0 [0032.367] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.367] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg")) returned 1 [0032.368] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC03B1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc03b1[1].jpg")) returned 0xffffffff [0032.368] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 1 [0032.368] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg")) returned 0x2020 [0032.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.369] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7bb, lpOverlapped=0x0) returned 1 [0032.371] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7bb, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7bb, lpOverlapped=0x0) returned 1 [0032.371] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.372] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.372] CloseHandle (hObject=0x100) returned 1 [0032.372] CloseHandle (hObject=0x114) returned 1 [0032.372] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg.crypt")) returned 0 [0032.373] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg.crypt")) returned 0x2020 [0032.373] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 0x5c9000 [0032.373] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52f0cdd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52f0cdd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52f0cdd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC06Ub[1].jpg", cAlternateFileName="BBC06U~1.JPG")) returned 0 [0032.373] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.373] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg")) returned 1 [0032.374] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc06ub[1].jpg")) returned 0xffffffff [0032.374] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0Djg[1].jpg", cAlternateFileName="BBC0DJ~1.JPG")) returned 1 [0032.374] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg")) returned 0x2020 [0032.374] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.374] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.375] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9ab, lpOverlapped=0x0) returned 1 [0032.376] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9ab, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9ab, lpOverlapped=0x0) returned 1 [0032.377] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.377] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.377] CloseHandle (hObject=0x114) returned 1 [0032.377] CloseHandle (hObject=0x100) returned 1 [0032.378] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg.crypt")) returned 0 [0032.378] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg.crypt")) returned 0x2020 [0032.378] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0Djg[1].jpg", cAlternateFileName="BBC0DJ~1.JPG")) returned 0x5c9000 [0032.378] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e74850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e74850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52e74850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0Djg[1].jpg", cAlternateFileName="BBC0DJ~1.JPG")) returned 0 [0032.378] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.379] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg")) returned 1 [0032.380] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0Djg[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0djg[1].jpg")) returned 0xffffffff [0032.380] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 1 [0032.380] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg")) returned 0x2020 [0032.380] VirtualAlloc (lpAddress=0x1fa0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000 [0032.381] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.381] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.381] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7fd, lpOverlapped=0x0) returned 1 [0032.383] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7fd, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7fd, lpOverlapped=0x0) returned 1 [0032.384] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.384] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.384] CloseHandle (hObject=0x100) returned 1 [0032.384] CloseHandle (hObject=0x114) returned 1 [0032.385] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg.crypt")) returned 0 [0032.385] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg.crypt")) returned 0x2020 [0032.385] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 0x5c9000 [0032.385] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52ec0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52ec0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52ec0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0g7a[1].jpg", cAlternateFileName="BBC0G7~1.JPG")) returned 0 [0032.385] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.385] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg")) returned 1 [0032.386] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0g7a[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0g7a[1].jpg")) returned 0xffffffff [0032.386] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0lf2[1].jpg", cAlternateFileName="BBC0LF~1.JPG")) returned 1 [0032.386] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg")) returned 0x2020 [0032.387] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.387] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.387] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x82f, lpOverlapped=0x0) returned 1 [0032.389] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x82f, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x82f, lpOverlapped=0x0) returned 1 [0032.390] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.390] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.390] CloseHandle (hObject=0x114) returned 1 [0032.390] CloseHandle (hObject=0x100) returned 1 [0032.391] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg.crypt")) returned 0 [0032.391] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg.crypt")) returned 0x2020 [0032.391] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0lf2[1].jpg", cAlternateFileName="BBC0LF~1.JPG")) returned 0x5c9000 [0032.391] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0lf2[1].jpg", cAlternateFileName="BBC0LF~1.JPG")) returned 0 [0032.391] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.391] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg")) returned 1 [0032.392] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0lf2[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0lf2[1].jpg")) returned 0xffffffff [0032.392] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2e35a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2e35a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2e35a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1afe, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0mK1[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 1 [0032.392] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg")) returned 0x2020 [0032.393] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.393] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.393] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.395] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.396] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xafe, lpOverlapped=0x0) returned 1 [0032.396] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xafe, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xafe, lpOverlapped=0x0) returned 1 [0032.396] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.396] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.396] CloseHandle (hObject=0x100) returned 1 [0032.396] CloseHandle (hObject=0x114) returned 1 [0032.397] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg.crypt")) returned 0 [0032.397] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg.crypt")) returned 0x2020 [0032.398] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2e35a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2e35a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2e35a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1afe, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0mK1[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 0x5c9000 [0032.398] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b2e35a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5b2e35a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b2e35a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1afe, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0mK1[1].jpg", cAlternateFileName="BBC0MK~1.JPG")) returned 0 [0032.398] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.398] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg")) returned 1 [0032.399] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0mK1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0mk1[1].jpg")) returned 0xffffffff [0032.399] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fc3, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBC0qlB[1].jpg", cAlternateFileName="BBC0QL~1.JPG")) returned 1 [0032.399] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg")) returned 0x2020 [0032.399] VirtualAlloc (lpAddress=0x1fa4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa4000 [0032.399] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.400] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.400] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.402] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.403] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xfc3, lpOverlapped=0x0) returned 1 [0032.404] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xfc3, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xfc3, lpOverlapped=0x0) returned 1 [0032.404] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.404] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.404] CloseHandle (hObject=0x114) returned 1 [0032.404] CloseHandle (hObject=0x100) returned 1 [0032.406] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg.crypt")) returned 0 [0032.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg.crypt")) returned 0x2020 [0032.407] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fc3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0qlB[1].jpg", cAlternateFileName="BBC0QL~1.JPG")) returned 0x5c9000 [0032.407] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fc3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBC0qlB[1].jpg", cAlternateFileName="BBC0QL~1.JPG")) returned 0 [0032.407] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.407] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg")) returned 1 [0032.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBC0qlB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbc0qlb[1].jpg")) returned 0xffffffff [0032.408] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBE7KPZ[1].jpg", cAlternateFileName="BBE7KP~1.JPG")) returned 1 [0032.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg")) returned 0x2020 [0032.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.409] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.411] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.412] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.412] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.412] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xecb, lpOverlapped=0x0) returned 1 [0032.412] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xecb, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xecb, lpOverlapped=0x0) returned 1 [0032.413] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.413] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.413] CloseHandle (hObject=0x100) returned 1 [0032.413] CloseHandle (hObject=0x114) returned 1 [0032.414] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg.crypt")) returned 0 [0032.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg.crypt")) returned 0x2020 [0032.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE7KPZ[1].jpg", cAlternateFileName="BBE7KP~1.JPG")) returned 0x5c9000 [0032.415] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE7KPZ[1].jpg", cAlternateFileName="BBE7KP~1.JPG")) returned 0 [0032.415] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.415] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg")) returned 1 [0032.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE7KPZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe7kpz[1].jpg")) returned 0xffffffff [0032.416] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBE8IlA[1].jpg", cAlternateFileName="BBE8IL~1.JPG")) returned 1 [0032.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg")) returned 0x2020 [0032.416] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.416] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.417] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9c5, lpOverlapped=0x0) returned 1 [0032.418] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9c5, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9c5, lpOverlapped=0x0) returned 1 [0032.419] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.419] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.419] CloseHandle (hObject=0x114) returned 1 [0032.419] CloseHandle (hObject=0x100) returned 1 [0032.420] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg.crypt")) returned 0 [0032.420] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg.crypt")) returned 0x2020 [0032.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE8IlA[1].jpg", cAlternateFileName="BBE8IL~1.JPG")) returned 0x5c9000 [0032.421] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a6bd70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a6bd70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a6bd70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE8IlA[1].jpg", cAlternateFileName="BBE8IL~1.JPG")) returned 0 [0032.421] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.421] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg")) returned 1 [0032.422] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE8IlA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe8ila[1].jpg")) returned 0xffffffff [0032.422] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2669, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBE972F[1].jpg", cAlternateFileName="BBE972~1.JPG")) returned 1 [0032.422] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg")) returned 0x2020 [0032.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.422] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.423] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.425] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.425] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.426] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.426] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x669, lpOverlapped=0x0) returned 1 [0032.426] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x669, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x669, lpOverlapped=0x0) returned 1 [0032.426] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.426] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.426] CloseHandle (hObject=0x100) returned 1 [0032.426] CloseHandle (hObject=0x114) returned 1 [0032.427] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg.crypt")) returned 0 [0032.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg.crypt")) returned 0x2020 [0032.428] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2669, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE972F[1].jpg", cAlternateFileName="BBE972~1.JPG")) returned 0x5c9000 [0032.428] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b9c870, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b9c870, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b9c870, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2669, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE972F[1].jpg", cAlternateFileName="BBE972~1.JPG")) returned 0 [0032.428] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.428] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg")) returned 1 [0032.429] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE972F[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe972f[1].jpg")) returned 0xffffffff [0032.429] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a77, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBE9tdx[1].jpg", cAlternateFileName="BBE9TD~1.JPG")) returned 1 [0032.429] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg")) returned 0x2020 [0032.429] VirtualAlloc (lpAddress=0x1fa8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa8000 [0032.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.430] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.432] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.433] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.433] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.433] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xa77, lpOverlapped=0x0) returned 1 [0032.433] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xa77, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xa77, lpOverlapped=0x0) returned 1 [0032.434] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.434] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.434] CloseHandle (hObject=0x114) returned 1 [0032.434] CloseHandle (hObject=0x100) returned 1 [0032.434] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg.crypt")) returned 0 [0032.435] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg.crypt")) returned 0x2020 [0032.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a77, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE9tdx[1].jpg", cAlternateFileName="BBE9TD~1.JPG")) returned 0x5c9000 [0032.435] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458308d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458308d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458308d0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a77, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBE9tdx[1].jpg", cAlternateFileName="BBE9TD~1.JPG")) returned 0 [0032.435] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.435] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg")) returned 1 [0032.436] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBE9tdx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbe9tdx[1].jpg")) returned 0xffffffff [0032.436] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEdrqt[1].jpg", cAlternateFileName="BBEDRQ~1.JPG")) returned 1 [0032.436] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg")) returned 0x2020 [0032.436] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.436] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.437] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.439] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.440] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.440] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.440] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xfe3, lpOverlapped=0x0) returned 1 [0032.440] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xfe3, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xfe3, lpOverlapped=0x0) returned 1 [0032.440] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.440] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.440] CloseHandle (hObject=0x100) returned 1 [0032.440] CloseHandle (hObject=0x114) returned 1 [0032.442] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg.crypt")) returned 0 [0032.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg.crypt")) returned 0x2020 [0032.442] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdrqt[1].jpg", cAlternateFileName="BBEDRQ~1.JPG")) returned 0x5c9000 [0032.442] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458a2cf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458a2cf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458a2cf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEdrqt[1].jpg", cAlternateFileName="BBEDRQ~1.JPG")) returned 0 [0032.442] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.442] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg")) returned 1 [0032.443] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEdrqt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbedrqt[1].jpg")) returned 0xffffffff [0032.443] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeEwt[1].jpg", cAlternateFileName="BBEEEW~1.JPG")) returned 1 [0032.443] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg")) returned 0x2020 [0032.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.444] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.444] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x857, lpOverlapped=0x0) returned 1 [0032.445] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x857, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x857, lpOverlapped=0x0) returned 1 [0032.446] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.446] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.446] CloseHandle (hObject=0x114) returned 1 [0032.446] CloseHandle (hObject=0x100) returned 1 [0032.447] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg.crypt")) returned 0 [0032.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg.crypt")) returned 0x2020 [0032.447] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeEwt[1].jpg", cAlternateFileName="BBEEEW~1.JPG")) returned 0x5c9000 [0032.447] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459ad690, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459ad690, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459ad690, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeEwt[1].jpg", cAlternateFileName="BBEEEW~1.JPG")) returned 0 [0032.447] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.448] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg")) returned 1 [0032.448] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeEwt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeewt[1].jpg")) returned 0xffffffff [0032.448] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeis3[1].jpg", cAlternateFileName="BBEEIS~1.JPG")) returned 1 [0032.449] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg")) returned 0x2020 [0032.449] VirtualAlloc (lpAddress=0x1fac000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fac000 [0032.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.449] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.449] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x7d9, lpOverlapped=0x0) returned 1 [0032.451] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x7d9, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x7d9, lpOverlapped=0x0) returned 1 [0032.452] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.452] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.452] CloseHandle (hObject=0x100) returned 1 [0032.452] CloseHandle (hObject=0x114) returned 1 [0032.453] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg.crypt")) returned 0 [0032.453] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg.crypt")) returned 0x2020 [0032.453] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeis3[1].jpg", cAlternateFileName="BBEEIS~1.JPG")) returned 0x5c9000 [0032.453] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4593b270, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4593b270, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4593b270, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeis3[1].jpg", cAlternateFileName="BBEEIS~1.JPG")) returned 0 [0032.453] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.453] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg")) returned 1 [0032.454] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeis3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeeis3[1].jpg")) returned 0xffffffff [0032.454] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeKvV[1].jpg", cAlternateFileName="BBEEKV~1.JPG")) returned 1 [0032.454] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg")) returned 0x2020 [0032.454] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.455] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.455] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x8c5, lpOverlapped=0x0) returned 1 [0032.456] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x8c5, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x8c5, lpOverlapped=0x0) returned 1 [0032.457] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.457] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.457] CloseHandle (hObject=0x114) returned 1 [0032.457] CloseHandle (hObject=0x100) returned 1 [0032.458] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg.crypt")) returned 0 [0032.458] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg.crypt")) returned 0x2020 [0032.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeKvV[1].jpg", cAlternateFileName="BBEEKV~1.JPG")) returned 0x5c9000 [0032.459] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a1fab0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a1fab0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45a1fab0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeKvV[1].jpg", cAlternateFileName="BBEEKV~1.JPG")) returned 0 [0032.459] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.459] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg")) returned 1 [0032.460] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeKvV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeekvv[1].jpg")) returned 0xffffffff [0032.460] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a91ed0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a91ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xef00, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeNd8[1].png", cAlternateFileName="BBEEND~1.PNG")) returned 1 [0032.460] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png")) returned 0x2020 [0032.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.460] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.463] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.464] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.464] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.464] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.464] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.464] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.464] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.465] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.465] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.465] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.465] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.465] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.465] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.466] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.466] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.466] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.466] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.466] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.466] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.466] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.467] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.467] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.467] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.467] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.467] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.467] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.467] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.468] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xf00, lpOverlapped=0x0) returned 1 [0032.468] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xf00, lpOverlapped=0x0) returned 1 [0032.468] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.468] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.468] CloseHandle (hObject=0x100) returned 1 [0032.468] CloseHandle (hObject=0x114) returned 1 [0032.469] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png.crypt")) returned 0 [0032.470] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png.crypt")) returned 0x2020 [0032.470] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a91ed0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a91ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xef00, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeNd8[1].png", cAlternateFileName="BBEEND~1.PNG")) returned 0x5c9000 [0032.470] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45a91ed0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45a91ed0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xef00, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeNd8[1].png", cAlternateFileName="BBEEND~1.PNG")) returned 0 [0032.470] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.470] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png")) returned 1 [0032.471] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeNd8[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeend8[1].png")) returned 0xffffffff [0032.471] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3323, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEewZB[1].jpg", cAlternateFileName="BBEEWZ~1.JPG")) returned 1 [0032.471] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg")) returned 0x2020 [0032.471] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.472] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.474] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.475] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.475] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.475] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.475] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.476] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x323, lpOverlapped=0x0) returned 1 [0032.476] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x323, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x323, lpOverlapped=0x0) returned 1 [0032.476] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.476] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.476] CloseHandle (hObject=0x114) returned 1 [0032.476] CloseHandle (hObject=0x100) returned 1 [0032.477] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg.crypt")) returned 0 [0032.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg.crypt")) returned 0x2020 [0032.477] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3323, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEewZB[1].jpg", cAlternateFileName="BBEEWZ~1.JPG")) returned 0x5c9000 [0032.477] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3323, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEewZB[1].jpg", cAlternateFileName="BBEEWZ~1.JPG")) returned 0 [0032.477] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.477] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg")) returned 1 [0032.478] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEewZB[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeewzb[1].jpg")) returned 0xffffffff [0032.478] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEeZ0k[1].jpg", cAlternateFileName="BBEEZ0~1.JPG")) returned 1 [0032.482] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg")) returned 0x2020 [0032.482] VirtualAlloc (lpAddress=0x1fb0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fb0000 [0032.482] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.483] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.483] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9d7, lpOverlapped=0x0) returned 1 [0032.484] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9d7, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9d7, lpOverlapped=0x0) returned 1 [0032.485] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.485] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.485] CloseHandle (hObject=0x100) returned 1 [0032.485] CloseHandle (hObject=0x114) returned 1 [0032.486] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg.crypt")) returned 0 [0032.486] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg.crypt")) returned 0x2020 [0032.486] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeZ0k[1].jpg", cAlternateFileName="BBEEZ0~1.JPG")) returned 0x5c9000 [0032.486] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459613d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459613d0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45987530, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEeZ0k[1].jpg", cAlternateFileName="BBEEZ0~1.JPG")) returned 0 [0032.487] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.487] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg")) returned 1 [0032.487] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEeZ0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbeez0k[1].jpg")) returned 0xffffffff [0032.488] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEf6s4[1].jpg", cAlternateFileName="BBEF6S~1.JPG")) returned 1 [0032.488] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg")) returned 0x2020 [0032.488] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.488] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.489] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.491] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.491] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.492] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.492] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xd32, lpOverlapped=0x0) returned 1 [0032.492] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xd32, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xd32, lpOverlapped=0x0) returned 1 [0032.492] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.492] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.492] CloseHandle (hObject=0x114) returned 1 [0032.492] CloseHandle (hObject=0x100) returned 1 [0032.493] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg.crypt")) returned 0 [0032.493] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg.crypt")) returned 0x2020 [0032.493] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEf6s4[1].jpg", cAlternateFileName="BBEF6S~1.JPG")) returned 0x5c9000 [0032.493] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b042f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b042f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b042f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEf6s4[1].jpg", cAlternateFileName="BBEF6S~1.JPG")) returned 0 [0032.493] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.494] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg")) returned 1 [0032.494] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEf6s4[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbef6s4[1].jpg")) returned 0xffffffff [0032.494] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfAc5[1].jpg", cAlternateFileName="BBEFAC~1.JPG")) returned 1 [0032.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg")) returned 0x2020 [0032.495] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.495] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.495] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x85d, lpOverlapped=0x0) returned 1 [0032.497] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x85d, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x85d, lpOverlapped=0x0) returned 1 [0032.498] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.498] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.498] CloseHandle (hObject=0x100) returned 1 [0032.498] CloseHandle (hObject=0x114) returned 1 [0032.499] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg.crypt")) returned 0 [0032.499] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg.crypt")) returned 0x2020 [0032.499] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfAc5[1].jpg", cAlternateFileName="BBEFAC~1.JPG")) returned 0x5c9000 [0032.499] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfAc5[1].jpg", cAlternateFileName="BBEFAC~1.JPG")) returned 0 [0032.499] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.499] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg")) returned 1 [0032.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfAc5[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefac5[1].jpg")) returned 0xffffffff [0032.500] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfgDi[1].jpg", cAlternateFileName="BBEFGD~1.JPG")) returned 1 [0032.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg")) returned 0x2020 [0032.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.501] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.501] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.503] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.504] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x97c, lpOverlapped=0x0) returned 1 [0032.504] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x97c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x97c, lpOverlapped=0x0) returned 1 [0032.504] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.504] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.504] CloseHandle (hObject=0x114) returned 1 [0032.505] CloseHandle (hObject=0x100) returned 1 [0032.505] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg.crypt")) returned 0 [0032.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg.crypt")) returned 0x2020 [0032.506] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfgDi[1].jpg", cAlternateFileName="BBEFGD~1.JPG")) returned 0x5c9000 [0032.506] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45510bf0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45510bf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45510bf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x197c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfgDi[1].jpg", cAlternateFileName="BBEFGD~1.JPG")) returned 0 [0032.506] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.506] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg")) returned 1 [0032.507] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfgDi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefgdi[1].jpg")) returned 0xffffffff [0032.507] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb7e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 1 [0032.507] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg")) returned 0x2020 [0032.508] VirtualAlloc (lpAddress=0x1fb4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fb4000 [0032.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.509] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.509] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xb7e, lpOverlapped=0x0) returned 1 [0032.511] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xb7e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xb7e, lpOverlapped=0x0) returned 1 [0032.511] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.511] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.512] CloseHandle (hObject=0x100) returned 1 [0032.512] CloseHandle (hObject=0x114) returned 1 [0032.512] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg.crypt")) returned 0 [0032.512] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg.crypt")) returned 0x2020 [0032.513] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb7e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 0x5c9000 [0032.513] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb7e, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfjuT[1].jpg", cAlternateFileName="BBEFJU~1.JPG")) returned 0 [0032.513] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.513] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg")) returned 1 [0032.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefjut[1].jpg")) returned 0xffffffff [0032.514] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1b14, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfkgi[1].jpg", cAlternateFileName="BBEFKG~1.JPG")) returned 1 [0032.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg")) returned 0x2020 [0032.514] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.514] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.515] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.517] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.517] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xb14, lpOverlapped=0x0) returned 1 [0032.518] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xb14, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xb14, lpOverlapped=0x0) returned 1 [0032.518] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.518] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.518] CloseHandle (hObject=0x114) returned 1 [0032.518] CloseHandle (hObject=0x100) returned 1 [0032.519] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg.crypt")) returned 0 [0032.519] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg.crypt")) returned 0x2020 [0032.519] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1b14, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfkgi[1].jpg", cAlternateFileName="BBEFKG~1.JPG")) returned 0x5c9000 [0032.519] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457be4b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457be4b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457be4b0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1b14, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfkgi[1].jpg", cAlternateFileName="BBEFKG~1.JPG")) returned 0 [0032.519] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.519] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg")) returned 1 [0032.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfkgi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefkgi[1].jpg")) returned 0xffffffff [0032.520] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2978, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfRKA[1].jpg", cAlternateFileName="BBEFRK~1.JPG")) returned 1 [0032.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg")) returned 0x2020 [0032.520] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.521] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.523] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.524] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.524] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.524] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x978, lpOverlapped=0x0) returned 1 [0032.524] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x978, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x978, lpOverlapped=0x0) returned 1 [0032.524] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.524] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.525] CloseHandle (hObject=0x100) returned 1 [0032.525] CloseHandle (hObject=0x114) returned 1 [0032.525] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg.crypt")) returned 0 [0032.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg.crypt")) returned 0x2020 [0032.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2978, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfRKA[1].jpg", cAlternateFileName="BBEFRK~1.JPG")) returned 0x5c9000 [0032.526] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45915110, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45915110, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45915110, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2978, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfRKA[1].jpg", cAlternateFileName="BBEFRK~1.JPG")) returned 0 [0032.526] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.526] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg")) returned 1 [0032.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRKA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrka[1].jpg")) returned 0xffffffff [0032.527] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfRwv[1].jpg", cAlternateFileName="BBEFRW~1.JPG")) returned 1 [0032.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg")) returned 0x2020 [0032.527] VirtualAlloc (lpAddress=0x1fb8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fb8000 [0032.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.528] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.530] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.531] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.531] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.531] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xb6c, lpOverlapped=0x0) returned 1 [0032.531] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xb6c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xb6c, lpOverlapped=0x0) returned 1 [0032.531] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.531] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.531] CloseHandle (hObject=0x114) returned 1 [0032.531] CloseHandle (hObject=0x100) returned 1 [0032.532] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg.crypt")) returned 0 [0032.532] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg.crypt")) returned 0x2020 [0032.532] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfRwv[1].jpg", cAlternateFileName="BBEFRW~1.JPG")) returned 0x5c9000 [0032.533] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4574c090, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4574c090, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457721f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfRwv[1].jpg", cAlternateFileName="BBEFRW~1.JPG")) returned 0 [0032.533] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.533] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg")) returned 1 [0032.534] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfRwv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefrwv[1].jpg")) returned 0xffffffff [0032.534] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45478670, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45478670, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45478670, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2676, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 1 [0032.534] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg")) returned 0x2020 [0032.534] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.534] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.535] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.537] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.537] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.538] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.538] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x676, lpOverlapped=0x0) returned 1 [0032.538] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x676, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x676, lpOverlapped=0x0) returned 1 [0032.538] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.538] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.538] CloseHandle (hObject=0x100) returned 1 [0032.538] CloseHandle (hObject=0x114) returned 1 [0032.539] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg.crypt")) returned 0 [0032.539] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg.crypt")) returned 0x2020 [0032.539] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45478670, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45478670, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45478670, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2676, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 0x5c9000 [0032.539] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45478670, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45478670, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45478670, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2676, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfwtU[1].jpg", cAlternateFileName="BBEFWT~1.JPG")) returned 0 [0032.539] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.540] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg")) returned 1 [0032.540] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfwtU[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefwtu[1].jpg")) returned 0xffffffff [0032.541] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb41, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEfY4X[1].jpg", cAlternateFileName="BBEFY4~1.JPG")) returned 1 [0032.541] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg")) returned 0x2020 [0032.541] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.541] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.541] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xb41, lpOverlapped=0x0) returned 1 [0032.543] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xb41, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xb41, lpOverlapped=0x0) returned 1 [0032.544] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.544] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.544] CloseHandle (hObject=0x114) returned 1 [0032.544] CloseHandle (hObject=0x100) returned 1 [0032.544] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg.crypt")) returned 0 [0032.545] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg.crypt")) returned 0x2020 [0032.545] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb41, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfY4X[1].jpg", cAlternateFileName="BBEFY4~1.JPG")) returned 0x5c9000 [0032.545] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45856a30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45856a30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xb41, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEfY4X[1].jpg", cAlternateFileName="BBEFY4~1.JPG")) returned 0 [0032.545] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.545] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg")) returned 1 [0032.546] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEfY4X[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbefy4x[1].jpg")) returned 0xffffffff [0032.546] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x25f6, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgD9f[1].jpg", cAlternateFileName="BBEGD9~1.JPG")) returned 1 [0032.546] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg")) returned 0x2020 [0032.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.547] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.548] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.549] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.550] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.550] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x5f6, lpOverlapped=0x0) returned 1 [0032.550] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x5f6, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x5f6, lpOverlapped=0x0) returned 1 [0032.550] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.550] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.550] CloseHandle (hObject=0x100) returned 1 [0032.550] CloseHandle (hObject=0x114) returned 1 [0032.551] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg.crypt")) returned 0 [0032.551] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg.crypt")) returned 0x2020 [0032.551] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x25f6, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgD9f[1].jpg", cAlternateFileName="BBEGD9~1.JPG")) returned 0x5c9000 [0032.551] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x25f6, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgD9f[1].jpg", cAlternateFileName="BBEGD9~1.JPG")) returned 0 [0032.551] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.552] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg")) returned 1 [0032.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgD9f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegd9f[1].jpg")) returned 0xffffffff [0032.552] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 1 [0032.553] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg")) returned 0x2020 [0032.553] VirtualAlloc (lpAddress=0x1fbc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fbc000 [0032.553] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.553] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.554] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x819, lpOverlapped=0x0) returned 1 [0032.555] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x819, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x819, lpOverlapped=0x0) returned 1 [0032.556] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.556] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.556] CloseHandle (hObject=0x114) returned 1 [0032.556] CloseHandle (hObject=0x100) returned 1 [0032.557] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg.crypt")) returned 0 [0032.557] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg.crypt")) returned 0x2020 [0032.557] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 0x5c9000 [0032.557] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45ab8030, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45ab8030, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45ab8030, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgJfz[1].jpg", cAlternateFileName="BBEGJF~1.JPG")) returned 0 [0032.557] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.557] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg")) returned 1 [0032.558] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegjfz[1].jpg")) returned 0xffffffff [0032.558] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgsWA[1].jpg", cAlternateFileName="BBEGSW~1.JPG")) returned 1 [0032.558] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg")) returned 0x2020 [0032.559] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.559] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.559] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x916, lpOverlapped=0x0) returned 1 [0032.561] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x916, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x916, lpOverlapped=0x0) returned 1 [0032.561] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.562] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.562] CloseHandle (hObject=0x100) returned 1 [0032.562] CloseHandle (hObject=0x114) returned 1 [0032.562] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg.crypt")) returned 0 [0032.563] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg.crypt")) returned 0x2020 [0032.563] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgsWA[1].jpg", cAlternateFileName="BBEGSW~1.JPG")) returned 0x5c9000 [0032.563] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45b2a450, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45b2a450, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45b2a450, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgsWA[1].jpg", cAlternateFileName="BBEGSW~1.JPG")) returned 0 [0032.563] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.563] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg")) returned 1 [0032.564] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgsWA[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegswa[1].jpg")) returned 0xffffffff [0032.564] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBEgX5G[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 1 [0032.564] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg")) returned 0x2020 [0032.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.565] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x918, lpOverlapped=0x0) returned 1 [0032.566] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x918, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x918, lpOverlapped=0x0) returned 1 [0032.567] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.567] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.567] CloseHandle (hObject=0x114) returned 1 [0032.567] CloseHandle (hObject=0x100) returned 1 [0032.568] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg.crypt")) returned 0 [0032.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg.crypt")) returned 0x2020 [0032.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgX5G[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 0x5c9000 [0032.568] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45725f30, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45725f30, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45725f30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBEgX5G[1].jpg", cAlternateFileName="BBEGX5~1.JPG")) returned 0 [0032.568] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.569] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg")) returned 1 [0032.569] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBEgX5G[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbegx5g[1].jpg")) returned 0xffffffff [0032.569] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBih5H[1].png", cAlternateFileName="BBIH5H~1.PNG")) returned 1 [0032.570] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png")) returned 0x2020 [0032.570] VirtualAlloc (lpAddress=0x1fc0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fc0000 [0032.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.570] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.570] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x3a2, lpOverlapped=0x0) returned 1 [0032.572] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x3a2, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x3a2, lpOverlapped=0x0) returned 1 [0032.573] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.573] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.573] CloseHandle (hObject=0x100) returned 1 [0032.573] CloseHandle (hObject=0x114) returned 1 [0032.574] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png.crypt")) returned 0 [0032.574] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png.crypt")) returned 0x2020 [0032.574] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="BBih5H[1].png", cAlternateFileName="BBIH5H~1.PNG")) returned 0x5c9000 [0032.574] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51256470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51256470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51256470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="BBih5H[1].png", cAlternateFileName="BBIH5H~1.PNG")) returned 0 [0032.574] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.574] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png")) returned 1 [0032.575] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBih5H[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbih5h[1].png")) returned 0xffffffff [0032.575] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBmUxRK[1].png", cAlternateFileName="BBMUXR~1.PNG")) returned 1 [0032.575] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png")) returned 0x2020 [0032.576] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.576] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.576] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x24c, lpOverlapped=0x0) returned 1 [0032.577] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x24c, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x24c, lpOverlapped=0x0) returned 1 [0032.578] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.578] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.578] CloseHandle (hObject=0x114) returned 1 [0032.578] CloseHandle (hObject=0x100) returned 1 [0032.581] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png.crypt")) returned 0 [0032.581] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png.crypt")) returned 0x2020 [0032.582] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBmUxRK[1].png", cAlternateFileName="BBMUXR~1.PNG")) returned 0x5c9000 [0032.582] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe4ca790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe4ca790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe4ca790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBmUxRK[1].png", cAlternateFileName="BBMUXR~1.PNG")) returned 0 [0032.582] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.582] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png")) returned 1 [0032.583] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBmUxRK[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbmuxrk[1].png")) returned 0xffffffff [0032.583] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBndhJA[1].png", cAlternateFileName="BBNDHJ~1.PNG")) returned 1 [0032.583] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png")) returned 0x2020 [0032.583] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.583] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.583] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x398, lpOverlapped=0x0) returned 1 [0032.585] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x398, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x398, lpOverlapped=0x0) returned 1 [0032.586] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.586] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.586] CloseHandle (hObject=0x100) returned 1 [0032.586] CloseHandle (hObject=0x114) returned 1 [0032.586] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png.crypt")) returned 0 [0032.587] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png.crypt")) returned 0x2020 [0032.587] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBndhJA[1].png", cAlternateFileName="BBNDHJ~1.PNG")) returned 0x5c9000 [0032.587] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x459f9950, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x459f9950, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x459f9950, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBndhJA[1].png", cAlternateFileName="BBNDHJ~1.PNG")) returned 0 [0032.587] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.587] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png")) returned 1 [0032.588] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBndhJA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbndhja[1].png")) returned 0xffffffff [0032.588] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBoqF0J[1].png", cAlternateFileName="BBOQF0~1.PNG")) returned 1 [0032.588] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png")) returned 0x2020 [0032.588] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.588] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.589] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x230, lpOverlapped=0x0) returned 1 [0032.590] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x230, lpOverlapped=0x0) returned 1 [0032.591] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.591] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.591] CloseHandle (hObject=0x114) returned 1 [0032.591] CloseHandle (hObject=0x100) returned 1 [0032.592] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png.crypt")) returned 0 [0032.592] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png.crypt")) returned 0x2020 [0032.592] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBoqF0J[1].png", cAlternateFileName="BBOQF0~1.PNG")) returned 0x5c9000 [0032.592] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x458c8e50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x458c8e50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x458c8e50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBoqF0J[1].png", cAlternateFileName="BBOQF0~1.PNG")) returned 0 [0032.592] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.592] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png")) returned 1 [0032.593] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBoqF0J[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bboqf0j[1].png")) returned 0xffffffff [0032.593] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="BBzjV9E[1].png", cAlternateFileName="BBZJV9~1.PNG")) returned 1 [0032.593] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png")) returned 0x2020 [0032.593] VirtualAlloc (lpAddress=0x1fc4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fc4000 [0032.594] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.594] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.594] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x116, lpOverlapped=0x0) returned 1 [0032.596] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x116, lpOverlapped=0x0) returned 1 [0032.596] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.596] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.597] CloseHandle (hObject=0x100) returned 1 [0032.597] CloseHandle (hObject=0x114) returned 1 [0032.597] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png.crypt")) returned 0 [0032.598] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png.crypt")) returned 0x2020 [0032.598] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBzjV9E[1].png", cAlternateFileName="BBZJV9~1.PNG")) returned 0x5c9000 [0032.598] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="BBzjV9E[1].png", cAlternateFileName="BBZJV9~1.PNG")) returned 0 [0032.598] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.598] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png")) returned 1 [0032.599] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\BBzjV9E[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\bbzjv9e[1].png")) returned 0xffffffff [0032.599] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60cdb940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60cdb940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fdaf, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="benefits-1[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 1 [0032.599] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg")) returned 0x2020 [0032.599] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.599] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.600] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.602] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.603] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.603] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.603] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.603] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.603] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.604] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.604] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.604] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.604] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.604] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.604] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.605] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.605] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.605] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.605] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.605] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.605] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.605] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.606] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.606] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.606] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.606] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.606] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.606] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.606] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.607] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.607] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.607] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.607] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.607] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.607] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.607] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.608] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.608] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.608] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.608] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.608] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.608] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.608] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.609] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.609] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.609] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.609] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.609] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.609] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.609] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.610] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.610] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.610] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.610] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.610] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.610] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.610] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.611] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.611] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.611] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.611] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.611] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.611] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.611] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.612] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0xdaf, lpOverlapped=0x0) returned 1 [0032.612] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0xdaf, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0xdaf, lpOverlapped=0x0) returned 1 [0032.612] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.612] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.612] CloseHandle (hObject=0x114) returned 1 [0032.612] CloseHandle (hObject=0x100) returned 1 [0032.614] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg.crypt")) returned 0 [0032.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg.crypt")) returned 0x2020 [0032.614] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60cdb940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60cdb940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fdaf, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="benefits-1[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 0x5c9000 [0032.614] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60cdb940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60cdb940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d4dd60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fdaf, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="benefits-1[1].jpg", cAlternateFileName="BENEFI~1.JPG")) returned 0 [0032.614] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.614] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg")) returned 1 [0032.616] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\benefits-1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\benefits-1[1].jpg")) returned 0xffffffff [0032.616] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6157c900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6157c900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x615c8bc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12282, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0032.616] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50fa0830, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x82d8, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="chartbeat[1].js", cAlternateFileName="CHARTB~1.JS")) returned 1 [0032.616] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c8f680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c8f680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d01aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3bf20, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="chrome-installer.min[1].js", cAlternateFileName="CHROME~1.JS")) returned 1 [0032.616] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60aec760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="chrome_logo_2x[1].png", cAlternateFileName="CHROME~1.PNG")) returned 1 [0032.616] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png")) returned 0x2020 [0032.617] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.617] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.617] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.619] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.620] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x622, lpOverlapped=0x0) returned 1 [0032.620] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x622, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x622, lpOverlapped=0x0) returned 1 [0032.620] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.620] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.620] CloseHandle (hObject=0x100) returned 1 [0032.620] CloseHandle (hObject=0x114) returned 1 [0032.621] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png.crypt")) returned 0 [0032.621] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png.crypt")) returned 0x2020 [0032.621] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60aec760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x5d6fc0, dwReserved1=0x18e59c, cFileName="chrome_logo_2x[1].png", cAlternateFileName="CHROME~1.PNG")) returned 0x5c9000 [0032.622] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60aec760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x5d6fc0, dwReserved1=0x18e59c, cFileName="chrome_logo_2x[1].png", cAlternateFileName="CHROME~1.PNG")) returned 0 [0032.622] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.622] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png")) returned 1 [0032.623] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\chrome_logo_2x[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\chrome_logo_2x[1].png")) returned 0xffffffff [0032.623] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x610b9d00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x610b9d00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="close-icon[1].png", cAlternateFileName="CLOSE-~1.PNG")) returned 1 [0032.623] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png")) returned 0x2020 [0032.623] VirtualAlloc (lpAddress=0x1fc8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fc8000 [0032.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.624] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x13d, lpOverlapped=0x0) returned 1 [0032.626] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x13d, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x13d, lpOverlapped=0x0) returned 1 [0032.627] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.627] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.627] CloseHandle (hObject=0x114) returned 1 [0032.627] CloseHandle (hObject=0x100) returned 1 [0032.627] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png.crypt")) returned 0 [0032.628] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png.crypt")) returned 0x2020 [0032.628] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x610b9d00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x610b9d00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="close-icon[1].png", cAlternateFileName="CLOSE-~1.PNG")) returned 0x5c9000 [0032.628] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x610b9d00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x610b9d00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="close-icon[1].png", cAlternateFileName="CLOSE-~1.PNG")) returned 0 [0032.628] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.628] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png")) returned 1 [0032.629] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\close-icon[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\close-icon[1].png")) returned 0xffffffff [0032.629] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269b2, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="css[1].txt", cAlternateFileName="CSS_1_~1.TXT")) returned 1 [0032.629] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt")) returned 0x2020 [0032.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.630] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.632] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.633] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.634] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.634] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.634] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.634] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.634] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.635] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.635] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.635] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.635] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.635] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.635] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.635] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.636] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.636] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.636] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.636] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.636] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.636] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.637] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.637] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.637] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.637] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.637] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.637] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.637] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.638] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.638] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.638] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.638] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.638] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.638] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.638] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.639] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.639] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.639] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.639] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.639] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.639] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.639] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.640] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.640] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.640] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.640] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.640] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.640] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.641] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.641] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.641] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.641] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.641] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.641] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.641] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.642] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.642] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.642] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.642] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.642] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.642] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.642] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.643] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.643] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.643] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.643] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.643] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.643] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.643] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.649] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.649] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.649] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.649] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.649] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.649] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.650] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.650] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x9b2, lpOverlapped=0x0) returned 1 [0032.650] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x9b2, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x9b2, lpOverlapped=0x0) returned 1 [0032.650] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.650] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.650] CloseHandle (hObject=0x100) returned 1 [0032.650] CloseHandle (hObject=0x114) returned 1 [0032.652] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt.crypt")) returned 0 [0032.652] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt.crypt")) returned 0x2020 [0032.652] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269b2, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="css[1].txt", cAlternateFileName="CSS_1_~1.TXT")) returned 0x5c9000 [0032.652] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269b2, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="css[1].txt", cAlternateFileName="CSS_1_~1.TXT")) returned 0 [0032.652] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.653] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt")) returned 1 [0032.654] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\css[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\css[1].txt")) returned 0xffffffff [0032.654] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0032.654] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini")) returned 0x2006 [0032.655] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.655] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.655] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x43, lpOverlapped=0x0) returned 1 [0032.656] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x43, lpOverlapped=0x0) returned 1 [0032.657] ReadFile (in: hFile=0x114, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.657] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.657] CloseHandle (hObject=0x114) returned 1 [0032.657] CloseHandle (hObject=0x100) returned 1 [0032.657] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini.crypt")) returned 0 [0032.657] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini.crypt")) returned 0x2020 [0032.657] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0032.658] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6fb0, dwReserved1=0x18e59c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0032.658] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.658] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini")) returned 1 [0032.659] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\desktop.ini")) returned 0xffffffff [0032.659] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf7af630, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7af630, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf821a50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4d5b9, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="ebHtml5Banner[1].js", cAlternateFileName="EBHTML~1.JS")) returned 1 [0032.659] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64009240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64009240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6402f3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5244, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="eula-win[1].jpg", cAlternateFileName="EULA-W~1.JPG")) returned 1 [0032.659] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg")) returned 0x2020 [0032.659] VirtualAlloc (lpAddress=0x1fcc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fcc000 [0032.659] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0032.660] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.660] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.662] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.663] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.663] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.664] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.664] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.664] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.664] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.664] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.664] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x1000, lpOverlapped=0x0) returned 1 [0032.665] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x244, lpOverlapped=0x0) returned 1 [0032.665] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x244, lpOverlapped=0x0) returned 1 [0032.665] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.665] WriteFile (in: hFile=0x114, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0032.665] CloseHandle (hObject=0x100) returned 1 [0032.665] CloseHandle (hObject=0x114) returned 1 [0032.666] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg.crypt")) returned 0 [0032.666] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg.crypt")) returned 0x2020 [0032.666] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64009240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64009240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6402f3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5244, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="eula-win[1].jpg", cAlternateFileName="EULA-W~1.JPG")) returned 0x5c9000 [0032.666] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64009240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64009240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6402f3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5244, dwReserved0=0x5d6ea0, dwReserved1=0x18e59c, cFileName="eula-win[1].jpg", cAlternateFileName="EULA-W~1.JPG")) returned 0 [0032.666] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.666] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg")) returned 1 [0032.667] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\eula-win[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\eula-win[1].jpg")) returned 0xffffffff [0032.667] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1303, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~3")) returned 1 [0032.668] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8c3, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0032.668] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe138690, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe138690, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe138690, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~2")) returned 1 [0032.668] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510ff810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510ff810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51125970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1762e, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="jquery-1.11.1.min[1].js", cAlternateFileName="JQUERY~1.JS")) returned 1 [0032.668] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5442d110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5442d110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5442d110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0032.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1 [0032.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d66650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d66650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e70ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7154, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0032.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e9b, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="latest[2].eot", cAlternateFileName="LATEST~2.EOT")) returned 1 [0032.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77b3, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="latest[3].eot", cAlternateFileName="LATEST~3.EOT")) returned 1 [0032.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53122110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x922, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="msn[1].htm", cAlternateFileName="MSN_1_~1.HTM")) returned 1 [0032.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6378e3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6378e3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x637b4540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3112, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="rpc_shindig_random[1].js", cAlternateFileName="RPC_SH~1.JS")) returned 1 [0032.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xbf7d5790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="thirdparty[1]", cAlternateFileName="THIRDP~1")) returned 1 [0032.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54adeef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="uid[1].htm", cAlternateFileName="UID_1_~1.HTM")) returned 1 [0032.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe5d5130, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe5d5130, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3325, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1 [0032.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 1 [0032.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x5d6e98, dwReserved1=0x18e534, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 0 [0032.669] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.669] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d74682e, dwReserved1=0x746f652e, cFileName="YG1R61Z8", cAlternateFileName="")) returned 0 [0032.669] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.669] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x342d3841, dwReserved1=0x2d414133, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0032.669] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini")) returned 0x2006 [0032.670] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0032.670] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.671] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0032.672] WriteFile (in: hFile=0xf8, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0032.673] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0032.673] WriteFile (in: hFile=0xf8, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0032.673] CloseHandle (hObject=0x104) returned 1 [0032.673] CloseHandle (hObject=0xf8) returned 1 [0032.674] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini.crypt")) returned 0 [0032.674] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini.crypt")) returned 0x2020 [0032.674] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6f88, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0032.674] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d6f88, dwReserved1=0x18ea6c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0032.674] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.674] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini")) returned 1 [0032.675] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\desktop.ini")) returned 0xffffffff [0032.675] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0032.675] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0 [0032.675] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.675] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0032.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.676] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="..", cAlternateFileName="")) returned 1 [0032.676] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="C", cAlternateFileName="")) returned 1 [0032.676] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.677] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.677] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0032.677] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.677] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.677] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0032.677] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.678] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.678] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0032.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0032.679] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.679] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0032.679] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0032.679] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="..", cAlternateFileName="")) returned 1 [0032.679] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0032.679] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18de00 | out: lpFindFileData=0x18de00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0032.680] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18de00 | out: lpFindFileData=0x18de00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="..", cAlternateFileName="")) returned 1 [0032.680] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18de00 | out: lpFindFileData=0x18de00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="Windows", cAlternateFileName="")) returned 1 [0032.680] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18db98 | out: lpFindFileData=0x18db98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0032.680] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18db98 | out: lpFindFileData=0x18db98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.681] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18db98 | out: lpFindFileData=0x18db98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0032.681] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18d930 | out: lpFindFileData=0x18d930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0032.681] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18d930 | out: lpFindFileData=0x18d930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.681] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18d930 | out: lpFindFileData=0x18d930*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0032.681] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18d6c8 | out: lpFindFileData=0x18d6c8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0032.681] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18d6c8 | out: lpFindFileData=0x18d6c8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.681] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18d6c8 | out: lpFindFileData=0x18d6c8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.681] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0032.682] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18d930 | out: lpFindFileData=0x18d930*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0032.682] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0032.682] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18db98 | out: lpFindFileData=0x18db98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 0 [0032.682] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0032.682] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18de00 | out: lpFindFileData=0x18de00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="Windows", cAlternateFileName="")) returned 0 [0032.682] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0032.682] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72004e, dwReserved1=0x4a0047, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0032.682] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0032.682] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0032.682] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0032.682] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0032.682] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.682] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0032.683] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.683] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0032.683] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.683] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d6e98, dwReserved1=0x18ea04, cFileName="C", cAlternateFileName="")) returned 0 [0032.683] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.683] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0032.683] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.683] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7264, dwReserved1=0x5f626262, cFileName="Themes", cAlternateFileName="")) returned 1 [0032.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.684] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0032.685] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1 [0032.685] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0 [0032.685] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.685] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x642e7265, dwReserved1=0x5f626262, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0032.685] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c3ce000, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x642e7265, dwReserved1=0x5f626262, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1 [0032.685] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7265, dwReserved1=0x5f626262, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1 [0032.685] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x642e7265, dwReserved1=0x5f626262, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1 [0032.685] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x642e7265, dwReserved1=0x5f626262, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1 [0032.685] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x642e7265, dwReserved1=0x5f626262, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1 [0032.685] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7265, dwReserved1=0x5f626262, cFileName="WER", cAlternateFileName="")) returned 1 [0032.685] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.686] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0032.686] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName="ERC", cAlternateFileName="")) returned 1 [0032.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fff8, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.686] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fff8, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0032.686] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fff8, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 0 [0032.686] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.686] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0032.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fff8, dwReserved1=0x20000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.686] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fff8, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 1 [0032.686] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fff8, dwReserved1=0x20000, cFileName="..", cAlternateFileName="")) returned 0 [0032.686] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.686] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0 [0032.686] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.687] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0032.687] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0 [0032.687] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.687] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c2e6574, dwReserved1=0x6137676f, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1 [0032.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0032.689] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="..", cAlternateFileName="")) returned 1 [0032.689] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1 [0032.689] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1 [0032.689] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1 [0032.689] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="Backup", cAlternateFileName="")) returned 1 [0032.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.689] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0032.689] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName="old", cAlternateFileName="")) returned 1 [0032.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.691] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.691] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0032.691] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0032.691] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0032.691] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0032.691] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.692] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d5e54, dwReserved1=0x18ec6c, cFileName="old", cAlternateFileName="")) returned 0 [0032.692] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.692] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0032.692] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="edb.log", cAlternateFileName="")) returned 1 [0032.692] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0032.692] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0032.692] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0032.692] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="oeold.xml", cAlternateFileName="")) returned 1 [0032.693] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0032.693] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.694] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 1 [0032.694] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0032.694] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0032.694] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 0x2020 [0032.695] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.695] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.695] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x432, lpOverlapped=0x0) returned 1 [0032.697] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x432, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x432, lpOverlapped=0x0) returned 1 [0032.698] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.698] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.698] CloseHandle (hObject=0x108) returned 1 [0032.698] CloseHandle (hObject=0xf8) returned 1 [0032.699] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.crypt")) returned 0 [0032.699] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.crypt")) returned 0x2020 [0032.699] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x5d0f48, dwReserved1=0x18ecd4, cFileName="Bears.jpg", cAlternateFileName="")) returned 0x5c8f40 [0032.699] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x5d0f48, dwReserved1=0x18ecd4, cFileName="Bears.jpg", cAlternateFileName="")) returned 0 [0032.699] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.699] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 1 [0032.700] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 0xffffffff [0032.700] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0032.700] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 0x2026 [0032.701] VirtualAlloc (lpAddress=0x1fd0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd0000 [0032.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.701] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x285, lpOverlapped=0x0) returned 1 [0032.702] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x285, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x285, lpOverlapped=0x0) returned 1 [0032.703] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.703] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.703] CloseHandle (hObject=0xf8) returned 1 [0032.703] CloseHandle (hObject=0x108) returned 1 [0032.704] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.crypt")) returned 0 [0032.704] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.crypt")) returned 0x2020 [0032.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x5d0f48, dwReserved1=0x18ecd4, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0032.704] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x5d0f48, dwReserved1=0x18ecd4, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0032.704] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.705] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 1 [0032.705] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 0xffffffff [0032.705] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0032.706] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0032.706] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 0x2020 [0032.706] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.706] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.707] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.709] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.710] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.710] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.710] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.710] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.710] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.710] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.710] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.711] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.711] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xd3f, lpOverlapped=0x0) returned 1 [0032.711] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xd3f, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xd3f, lpOverlapped=0x0) returned 1 [0032.711] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.711] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.711] CloseHandle (hObject=0x108) returned 1 [0032.711] CloseHandle (hObject=0xf8) returned 1 [0032.712] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.crypt")) returned 0 [0032.712] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.crypt")) returned 0x2020 [0032.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x5d0f48, dwReserved1=0x18ecd4, cFileName="Garden.jpg", cAlternateFileName="")) returned 0x5c8f40 [0032.713] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x5d0f48, dwReserved1=0x18ecd4, cFileName="Garden.jpg", cAlternateFileName="")) returned 0 [0032.713] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.713] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 1 [0032.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 0xffffffff [0032.714] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1 [0032.714] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1 [0032.714] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 0x2020 [0032.714] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.714] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.715] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.717] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.717] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x906, lpOverlapped=0x0) returned 1 [0032.718] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x906, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x906, lpOverlapped=0x0) returned 1 [0032.718] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.718] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.718] CloseHandle (hObject=0xf8) returned 1 [0032.718] CloseHandle (hObject=0x108) returned 1 [0032.719] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.crypt")) returned 0 [0032.719] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.crypt")) returned 0x2020 [0032.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x5d0f58, dwReserved1=0x18ecd4, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 0x5c8f40 [0032.719] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x5d0f58, dwReserved1=0x18ecd4, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 0 [0032.719] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.719] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 1 [0032.720] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 0xffffffff [0032.720] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1 [0032.720] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1 [0032.720] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 0x2020 [0032.720] VirtualAlloc (lpAddress=0x1fd4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd4000 [0032.721] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.721] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.721] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.723] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.724] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x7e, lpOverlapped=0x0) returned 1 [0032.724] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x7e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x7e, lpOverlapped=0x0) returned 1 [0032.725] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.725] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.725] CloseHandle (hObject=0x108) returned 1 [0032.725] CloseHandle (hObject=0xf8) returned 1 [0032.725] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.crypt")) returned 0 [0032.726] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.crypt")) returned 0x2020 [0032.726] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x5d0f50, dwReserved1=0x18ecd4, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 0x5c8f40 [0032.726] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x5d0f50, dwReserved1=0x18ecd4, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 0 [0032.726] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.726] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 1 [0032.727] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 0xffffffff [0032.727] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1 [0032.727] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1 [0032.727] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 0x2020 [0032.728] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.728] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.728] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.730] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.731] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x8ed, lpOverlapped=0x0) returned 1 [0032.731] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x8ed, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x8ed, lpOverlapped=0x0) returned 1 [0032.731] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.731] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.731] CloseHandle (hObject=0xf8) returned 1 [0032.731] CloseHandle (hObject=0x108) returned 1 [0032.732] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.crypt")) returned 0 [0032.732] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.crypt")) returned 0x2020 [0032.732] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x5d0f58, dwReserved1=0x18ecd4, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 0x5c8f40 [0032.733] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x5d0f58, dwReserved1=0x18ecd4, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 0 [0032.733] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.733] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 1 [0032.734] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 0xffffffff [0032.734] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0032.734] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0032.734] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 0x2020 [0032.734] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.734] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.735] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.737] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.738] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x3fb, lpOverlapped=0x0) returned 1 [0032.738] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x3fb, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x3fb, lpOverlapped=0x0) returned 1 [0032.738] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.738] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.738] CloseHandle (hObject=0x108) returned 1 [0032.738] CloseHandle (hObject=0xf8) returned 1 [0032.739] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.crypt")) returned 0 [0032.739] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.crypt")) returned 0x2020 [0032.739] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x5d0f48, dwReserved1=0x18ecd4, cFileName="Peacock.jpg", cAlternateFileName="")) returned 0x5c8f40 [0032.739] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x5d0f48, dwReserved1=0x18ecd4, cFileName="Peacock.jpg", cAlternateFileName="")) returned 0 [0032.739] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.739] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 1 [0032.740] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 0xffffffff [0032.740] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0032.740] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0032.741] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 0x2020 [0032.742] VirtualAlloc (lpAddress=0x1fd8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd8000 [0032.742] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.742] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.743] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x780, lpOverlapped=0x0) returned 1 [0032.744] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x780, lpOverlapped=0x0) returned 1 [0032.745] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.745] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.745] CloseHandle (hObject=0xf8) returned 1 [0032.746] CloseHandle (hObject=0x108) returned 1 [0032.746] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.crypt")) returned 0 [0032.746] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.crypt")) returned 0x2020 [0032.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x5d0f48, dwReserved1=0x18ecd4, cFileName="Roses.jpg", cAlternateFileName="")) returned 0x5c8f40 [0032.747] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x5d0f48, dwReserved1=0x18ecd4, cFileName="Roses.jpg", cAlternateFileName="")) returned 0 [0032.747] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.747] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 1 [0032.748] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 0xffffffff [0032.748] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1 [0032.748] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1 [0032.748] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 0x2020 [0032.748] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.748] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.748] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.750] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.751] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x27e, lpOverlapped=0x0) returned 1 [0032.751] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x27e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x27e, lpOverlapped=0x0) returned 1 [0032.752] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.752] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.752] CloseHandle (hObject=0x108) returned 1 [0032.752] CloseHandle (hObject=0xf8) returned 1 [0032.753] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.crypt")) returned 0 [0032.753] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.crypt")) returned 0x2020 [0032.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x5d0f58, dwReserved1=0x18ecd4, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 0x5c8f40 [0032.753] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x5d0f58, dwReserved1=0x18ecd4, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 0 [0032.753] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.753] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 1 [0032.754] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 0xffffffff [0032.754] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1 [0032.754] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0032.754] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 0x2020 [0032.755] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.755] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.756] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.758] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.758] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.759] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.759] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x949, lpOverlapped=0x0) returned 1 [0032.759] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x949, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x949, lpOverlapped=0x0) returned 1 [0032.759] ReadFile (in: hFile=0xf8, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.759] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.759] CloseHandle (hObject=0xf8) returned 1 [0032.759] CloseHandle (hObject=0x108) returned 1 [0032.760] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.crypt")) returned 0 [0032.760] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.crypt")) returned 0x2020 [0032.760] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x5d0f50, dwReserved1=0x18ecd4, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 0x5c8f40 [0032.760] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x5d0f50, dwReserved1=0x18ecd4, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 0 [0032.760] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.761] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 1 [0032.761] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 0xffffffff [0032.761] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0032.762] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0032.762] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 0x2020 [0032.762] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.762] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.762] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.764] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0032.765] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xd51, lpOverlapped=0x0) returned 1 [0032.765] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xd51, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xd51, lpOverlapped=0x0) returned 1 [0032.765] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.765] WriteFile (in: hFile=0xf8, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.765] CloseHandle (hObject=0x108) returned 1 [0032.766] CloseHandle (hObject=0xf8) returned 1 [0032.766] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.crypt")) returned 0 [0032.767] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.crypt")) returned 0x2020 [0032.767] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x5d0f48, dwReserved1=0x18ecd4, cFileName="Stars.jpg", cAlternateFileName="")) returned 0x5c8f40 [0032.767] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x5d0f48, dwReserved1=0x18ecd4, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0032.767] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.767] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 1 [0032.768] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 0xffffffff [0032.768] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0032.768] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.768] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0032.768] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0032.768] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0032.768] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.768] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0032.768] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0032.769] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="..", cAlternateFileName="")) returned 1 [0032.769] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="12.0", cAlternateFileName="")) returned 1 [0032.769] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.769] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0032.769] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1 [0032.769] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1 [0032.770] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0 [0032.770] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.770] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="12.0", cAlternateFileName="")) returned 0 [0032.770] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.770] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0032.770] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0032.770] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="..", cAlternateFileName="")) returned 1 [0032.770] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0032.770] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.771] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0032.771] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 0 [0032.771] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.771] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="Settings.ini", cAlternateFileName="")) returned 1 [0032.771] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 0x2020 [0032.772] VirtualAlloc (lpAddress=0x1fdc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fdc000 [0032.772] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0032.772] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.772] ReadFile (in: hFile=0xfc, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x54, lpOverlapped=0x0) returned 1 [0032.773] WriteFile (in: hFile=0xf8, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x54, lpOverlapped=0x0) returned 1 [0032.774] ReadFile (in: hFile=0xfc, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0032.774] WriteFile (in: hFile=0xf8, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0032.774] CloseHandle (hObject=0xfc) returned 1 [0032.774] CloseHandle (hObject=0xf8) returned 1 [0032.776] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.crypt")) returned 0 [0032.776] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.crypt")) returned 0x2020 [0032.776] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x5d0f40, dwReserved1=0x18ef3c, cFileName="Settings.ini", cAlternateFileName="")) returned 0x5c8f00 [0032.776] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x5d0f40, dwReserved1=0x18ef3c, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0032.776] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.776] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 1 [0032.777] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 0xffffffff [0032.777] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0032.777] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.777] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0032.777] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0032.777] FindNextFileA (in: hFindFile=0x5c5cf8, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x6769666e, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0032.777] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0032.778] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 1 [0032.778] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 0 [0032.778] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0032.779] FindNextFileA (in: hFindFile=0x5c5cf8, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x6769666e, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0032.779] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0032.779] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 1 [0032.779] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="Firefox", cAlternateFileName="")) returned 1 [0032.779] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0032.780] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0032.780] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Profiles", cAlternateFileName="")) returned 1 [0032.780] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.780] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.780] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0032.780] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.782] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.782] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0032.782] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.784] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.784] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0032.784] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.785] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.785] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="98", cAlternateFileName="")) returned 1 [0032.785] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.785] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.785] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8cd19f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="B60F3d01", cAlternateFileName="")) returned 1 [0032.785] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8cd19f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x0, cFileName="B60F3d01", cAlternateFileName="")) returned 0 [0032.785] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.786] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8", cAlternateFileName="")) returned 1 [0032.786] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.786] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.786] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x0, dwReserved1=0x0, cFileName="C3B7Bd01", cAlternateFileName="")) returned 1 [0032.786] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x0, dwReserved1=0x0, cFileName="C3B7Bd01", cAlternateFileName="")) returned 0 [0032.786] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.787] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A8", cAlternateFileName="")) returned 0 [0032.787] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.787] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1", cAlternateFileName="")) returned 1 [0032.787] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.787] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.787] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B", cAlternateFileName="")) returned 1 [0032.787] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.787] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.787] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x204fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="FCBF5d01", cAlternateFileName="")) returned 1 [0032.787] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x204fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="FCBF5d01", cAlternateFileName="")) returned 0 [0032.787] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.787] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2", cAlternateFileName="")) returned 1 [0032.787] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.788] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.788] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8272e2f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa05, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B619d01", cAlternateFileName="")) returned 1 [0032.788] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8272e2f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa05, dwReserved0=0x0, dwReserved1=0x0, cFileName="0B619d01", cAlternateFileName="")) returned 0 [0032.788] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.788] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6", cAlternateFileName="")) returned 1 [0032.788] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.789] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.789] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CBD4Dd01", cAlternateFileName="")) returned 1 [0032.789] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CBD4Dd01", cAlternateFileName="")) returned 0 [0032.789] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.789] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F6", cAlternateFileName="")) returned 0 [0032.789] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.789] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2", cAlternateFileName="")) returned 1 [0032.789] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.790] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.790] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.790] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.790] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3", cAlternateFileName="")) returned 1 [0032.790] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.791] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.791] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 1 [0032.791] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.792] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.792] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb72eeab0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x20543, dwReserved0=0x0, dwReserved1=0x0, cFileName="1D8FDd01", cAlternateFileName="")) returned 1 [0032.792] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb72eeab0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x20543, dwReserved0=0x0, dwReserved1=0x0, cFileName="1D8FDd01", cAlternateFileName="")) returned 0 [0032.792] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.792] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4B", cAlternateFileName="")) returned 0 [0032.792] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.792] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4", cAlternateFileName="")) returned 1 [0032.792] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.792] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.792] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.792] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.792] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5", cAlternateFileName="")) returned 1 [0032.792] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.793] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.793] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.793] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.793] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6", cAlternateFileName="")) returned 1 [0032.793] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.794] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.794] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.794] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.794] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="7", cAlternateFileName="")) returned 1 [0032.794] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.795] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.795] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.795] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.795] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8", cAlternateFileName="")) returned 1 [0032.795] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.795] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.795] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.795] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.795] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9", cAlternateFileName="")) returned 1 [0032.795] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.796] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.796] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0032.796] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.797] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.797] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x534f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16A09d01", cAlternateFileName="")) returned 1 [0032.797] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x534f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16A09d01", cAlternateFileName="")) returned 0 [0032.797] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.797] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2C", cAlternateFileName="")) returned 1 [0032.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.797] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.797] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7dcaf10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x133d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="24B53d01", cAlternateFileName="")) returned 1 [0032.797] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7dcaf10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x133d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="24B53d01", cAlternateFileName="")) returned 0 [0032.797] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.797] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="61", cAlternateFileName="")) returned 1 [0032.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.798] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.798] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fba0f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa949, dwReserved0=0x0, dwReserved1=0x0, cFileName="28E95d01", cAlternateFileName="")) returned 1 [0032.798] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fba0f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa949, dwReserved0=0x0, dwReserved1=0x0, cFileName="28E95d01", cAlternateFileName="")) returned 0 [0032.798] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.798] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E0", cAlternateFileName="")) returned 1 [0032.798] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.799] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.799] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x404f, dwReserved0=0x0, dwReserved1=0x0, cFileName="F17B2d01", cAlternateFileName="")) returned 1 [0032.799] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x404f, dwReserved0=0x0, dwReserved1=0x0, cFileName="F17B2d01", cAlternateFileName="")) returned 0 [0032.799] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.799] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E0", cAlternateFileName="")) returned 0 [0032.799] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.799] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A", cAlternateFileName="")) returned 1 [0032.799] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.799] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.799] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.799] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.799] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B", cAlternateFileName="")) returned 1 [0032.799] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.800] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.800] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.800] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.801] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1 [0032.801] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.801] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.801] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E6", cAlternateFileName="")) returned 1 [0032.801] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.801] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.801] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f21b70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x21839, dwReserved0=0x0, dwReserved1=0x0, cFileName="9DCB7d01", cAlternateFileName="")) returned 1 [0032.801] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f21b70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x21839, dwReserved0=0x0, dwReserved1=0x0, cFileName="9DCB7d01", cAlternateFileName="")) returned 0 [0032.801] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.801] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E6", cAlternateFileName="")) returned 0 [0032.801] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.801] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D", cAlternateFileName="")) returned 1 [0032.801] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.802] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.802] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="08", cAlternateFileName="")) returned 1 [0032.802] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.803] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.803] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8266, dwReserved0=0x0, dwReserved1=0x0, cFileName="71469d01", cAlternateFileName="")) returned 1 [0032.803] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8266, dwReserved0=0x0, dwReserved1=0x0, cFileName="71469d01", cAlternateFileName="")) returned 0 [0032.803] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.803] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="08", cAlternateFileName="")) returned 0 [0032.803] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.803] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="E", cAlternateFileName="")) returned 1 [0032.803] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.804] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.804] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="69", cAlternateFileName="")) returned 1 [0032.804] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.806] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.806] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb80063b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="885EEd01", cAlternateFileName="")) returned 1 [0032.806] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb80063b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="885EEd01", cAlternateFileName="")) returned 0 [0032.806] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.806] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="69", cAlternateFileName="")) returned 0 [0032.807] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.807] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F", cAlternateFileName="")) returned 1 [0032.807] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.807] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.807] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="23", cAlternateFileName="")) returned 1 [0032.807] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.808] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.808] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf888, dwReserved0=0x0, dwReserved1=0x0, cFileName="7E0FEd01", cAlternateFileName="")) returned 1 [0032.808] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf888, dwReserved0=0x0, dwReserved1=0x0, cFileName="7E0FEd01", cAlternateFileName="")) returned 0 [0032.808] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.808] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0", cAlternateFileName="")) returned 1 [0032.808] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0032.809] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.809] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x823c2350, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa80f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECB2Dd01", cAlternateFileName="")) returned 1 [0032.809] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x823c2350, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa80f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECB2Dd01", cAlternateFileName="")) returned 0 [0032.809] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0032.809] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F0", cAlternateFileName="")) returned 0 [0032.809] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.809] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x851226b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_001_", cAlternateFileName="_CACHE~2")) returned 1 [0032.809] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x851e0d90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_002_", cAlternateFileName="_CACHE~3")) returned 1 [0032.809] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8529f470, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_003_", cAlternateFileName="_CACHE~4")) returned 1 [0032.809] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8535db50, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2114, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_MAP_", cAlternateFileName="_CACHE~1")) returned 1 [0032.809] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8535db50, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2114, dwReserved0=0x0, dwReserved1=0x0, cFileName="_CACHE_MAP_", cAlternateFileName="_CACHE~1")) returned 0 [0032.809] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.809] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfflineCache", cAlternateFileName="OFFLIN~1")) returned 1 [0032.809] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.810] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.810] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc399b820, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 1 [0032.810] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc399b820, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 0 [0032.810] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.810] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65, dwReserved1=0x0, cFileName="safebrowsing", cAlternateFileName="SAFEBR~2")) returned 1 [0032.810] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.812] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.812] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x825fd7f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x825fd7f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x825fd7f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="test-malware-simple.cache", cAlternateFileName="TEST-M~1.CAC")) returned 1 [0032.812] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8234ff30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="test-malware-simple.pset", cAlternateFileName="TEST-M~1.PSE")) returned 1 [0032.813] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82376090, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="test-malware-simple.sbstore", cAlternateFileName="TEST-M~1.SBS")) returned 1 [0032.813] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82695d70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82695d70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82695d70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="test-phish-simple.cache", cAlternateFileName="TEST-P~1.CAC")) returned 1 [0032.813] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="test-phish-simple.pset", cAlternateFileName="TEST-P~1.PSE")) returned 1 [0032.813] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82649ab0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82649ab0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 1 [0032.813] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82649ab0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82649ab0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 0 [0032.813] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.813] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706d6973, dwReserved1=0x732e656c, cFileName="startupCache", cAlternateFileName="STARTU~1")) returned 1 [0032.813] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.814] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.814] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x854b47b0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe59f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="startupCache.4.little", cAlternateFileName="STARTU~1.LIT")) returned 1 [0032.814] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x854b47b0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe59f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="startupCache.4.little", cAlternateFileName="STARTU~1.LIT")) returned 0 [0032.814] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.814] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e342e65, dwReserved1=0x7474696c, cFileName="thumbnails", cAlternateFileName="THUMBN~1")) returned 1 [0032.815] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.817] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.817] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83cc0a50, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83cc0a50, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4cc87c1409819bf06f42b782d4902b2f.png", cAlternateFileName="4CC87C~1.PNG")) returned 1 [0032.817] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png")) returned 0x2020 [0032.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0032.818] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.818] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.820] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.821] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.821] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.821] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.822] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.822] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.822] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.822] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0xb0, lpOverlapped=0x0) returned 1 [0032.822] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0xb0, lpOverlapped=0x0) returned 1 [0032.822] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0032.822] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0032.822] CloseHandle (hObject=0x104) returned 1 [0032.822] CloseHandle (hObject=0x114) returned 1 [0032.823] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.crypt")) returned 0 [0032.824] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.crypt")) returned 0x2020 [0032.824] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83cc0a50, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83cc0a50, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x5d0fa0, dwReserved1=0x18e804, cFileName="4cc87c1409819bf06f42b782d4902b2f.png", cAlternateFileName="4CC87C~1.PNG")) returned 0x5c8fc0 [0032.824] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83cc0a50, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83cc0a50, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x5d0fa0, dwReserved1=0x18e804, cFileName="4cc87c1409819bf06f42b782d4902b2f.png", cAlternateFileName="4CC87C~1.PNG")) returned 0 [0032.824] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.824] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png")) returned 1 [0032.825] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png")) returned 0xffffffff [0032.825] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83ce6bb0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ba182bcd131f1f3c6b6fbbb1ba078341.png", cAlternateFileName="BA182B~1.PNG")) returned 1 [0032.825] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png")) returned 0x2020 [0032.825] VirtualAlloc (lpAddress=0x1fe0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe0000 [0032.826] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.826] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0032.826] ReadFile (in: hFile=0x114, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.828] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.829] ReadFile (in: hFile=0x114, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.829] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.830] ReadFile (in: hFile=0x114, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.830] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.830] ReadFile (in: hFile=0x114, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.830] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.830] ReadFile (in: hFile=0x114, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0xb0, lpOverlapped=0x0) returned 1 [0032.830] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0xb0, lpOverlapped=0x0) returned 1 [0032.830] ReadFile (in: hFile=0x114, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0032.830] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0032.831] CloseHandle (hObject=0x114) returned 1 [0032.831] CloseHandle (hObject=0x104) returned 1 [0032.831] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.crypt")) returned 0 [0032.831] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.crypt")) returned 0x2020 [0032.832] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83ce6bb0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x5d0fa0, dwReserved1=0x18e804, cFileName="ba182bcd131f1f3c6b6fbbb1ba078341.png", cAlternateFileName="BA182B~1.PNG")) returned 0x5c8fc0 [0032.832] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83ce6bb0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x83ce6bb0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83ce6bb0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x5d0fa0, dwReserved1=0x18e804, cFileName="ba182bcd131f1f3c6b6fbbb1ba078341.png", cAlternateFileName="BA182B~1.PNG")) returned 0 [0032.832] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.832] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png")) returned 1 [0032.833] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png")) returned 0xffffffff [0032.833] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 1 [0032.833] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png")) returned 0x2020 [0032.834] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0032.834] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.834] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.836] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.837] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.837] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.838] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.838] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.838] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.838] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.838] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.838] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.838] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.839] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.839] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.839] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.839] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.839] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.839] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.839] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.840] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.840] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.840] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.840] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.840] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.840] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.841] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.841] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.841] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.841] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.841] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.841] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.842] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.842] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.842] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.842] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.842] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.842] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.842] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.843] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.843] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.843] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.843] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.843] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.843] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.843] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.844] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.844] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.844] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.844] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.844] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.844] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.845] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.845] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.845] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.845] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.845] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.845] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x1000, lpOverlapped=0x0) returned 1 [0032.845] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x362, lpOverlapped=0x0) returned 1 [0032.845] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x362, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x362, lpOverlapped=0x0) returned 1 [0032.846] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0032.846] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0032.846] CloseHandle (hObject=0x104) returned 1 [0032.846] CloseHandle (hObject=0x114) returned 1 [0032.848] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.crypt")) returned 0 [0032.848] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.crypt")) returned 0x2020 [0032.848] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x5d0fa0, dwReserved1=0x18e804, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 0x5c8fc0 [0032.848] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x5d0fa0, dwReserved1=0x18e804, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 0 [0032.848] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.848] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png")) returned 1 [0032.850] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png")) returned 0xffffffff [0032.850] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb97ade50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb97ade50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb97ade50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ce8c0453589216a67cddb50284fbfe8d.png", cAlternateFileName="CE8C04~1.PNG")) returned 0 [0032.850] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.850] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x61363132, dwReserved1=0x64633736, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 1 [0032.850] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x61363132, dwReserved1=0x64633736, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 0 [0032.850] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.850] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0032.850] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.850] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Profiles", cAlternateFileName="")) returned 0 [0032.850] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.850] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="updates", cAlternateFileName="")) returned 1 [0032.850] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c756166, dwReserved1=0x5a0074, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0032.851] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c756166, dwReserved1=0x5a0074, cFileName="..", cAlternateFileName="")) returned 1 [0032.851] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c756166, dwReserved1=0x5a0074, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 1 [0032.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f4e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.853] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f4e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.853] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x5f4e, dwReserved1=0x0, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 1 [0032.853] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f4e, dwReserved1=0x0, cFileName="updates", cAlternateFileName="")) returned 1 [0032.853] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.853] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.853] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0032.854] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.854] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.854] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x818016b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x927c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.mar", cAlternateFileName="")) returned 1 [0032.854] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 1 [0032.854] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x0, dwReserved1=0x0, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 0 [0032.854] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.854] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 0 [0032.854] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.854] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x5f4e, dwReserved1=0x0, cFileName="updates.xml", cAlternateFileName="")) returned 1 [0032.854] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x5f4e, dwReserved1=0x0, cFileName="updates.xml", cAlternateFileName="")) returned 0 [0032.854] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.854] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c756166, dwReserved1=0x5a0074, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 0 [0032.854] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.854] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="updates", cAlternateFileName="")) returned 0 [0032.854] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0032.855] FindNextFileA (in: hFindFile=0x5c5cf8, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9fce33a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9fce33a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x6769666e, cFileName="Temp", cAlternateFileName="")) returned 1 [0032.855] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9fce33a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9fce33a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31313243, dwReserved1=0x61737342, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0032.855] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9fce33a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9fce33a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31313243, dwReserved1=0x61737342, cFileName="..", cAlternateFileName="")) returned 1 [0032.855] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x72832060, ftCreationTime.dwHighDateTime=0x1d4d344, ftLastAccessTime.dwLowDateTime=0xd2486720, ftLastAccessTime.dwHighDateTime=0x1d4c792, ftLastWriteTime.dwLowDateTime=0xd2486720, ftLastWriteTime.dwHighDateTime=0x1d4c792, nFileSizeHigh=0x0, nFileSizeLow=0xf07a, dwReserved0=0x31313243, dwReserved1=0x61737342, cFileName="-32ImSs.mp3", cAlternateFileName="")) returned 1 [0032.855] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1142ffd0, ftCreationTime.dwHighDateTime=0x1d4cb76, ftLastAccessTime.dwLowDateTime=0x38747c0, ftLastAccessTime.dwHighDateTime=0x1d4c860, ftLastWriteTime.dwLowDateTime=0x38747c0, ftLastWriteTime.dwHighDateTime=0x1d4c860, nFileSizeHigh=0x0, nFileSizeLow=0x3231, dwReserved0=0x31313243, dwReserved1=0x61737342, cFileName="00rAXylRhtDO.mp3", cAlternateFileName="00RAXY~1.MP3")) returned 1 [0032.855] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x261b3900, ftCreationTime.dwHighDateTime=0x1d4d0c5, ftLastAccessTime.dwLowDateTime=0x718368a0, ftLastAccessTime.dwHighDateTime=0x1d4d09c, ftLastWriteTime.dwLowDateTime=0x718368a0, ftLastWriteTime.dwHighDateTime=0x1d4d09c, nFileSizeHigh=0x0, nFileSizeLow=0x87a9, dwReserved0=0x31313243, dwReserved1=0x61737342, cFileName="2hw08W4XHVfXRAj.m4a", cAlternateFileName="2HW08W~1.M4A")) returned 1 [0032.855] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc5d822e0, ftCreationTime.dwHighDateTime=0x1d4cf95, ftLastAccessTime.dwLowDateTime=0x1c24f20, ftLastAccessTime.dwHighDateTime=0x1d4cd56, ftLastWriteTime.dwLowDateTime=0x1c24f20, ftLastWriteTime.dwHighDateTime=0x1d4cd56, nFileSizeHigh=0x0, nFileSizeLow=0x18af0, dwReserved0=0x31313243, dwReserved1=0x61737342, cFileName="5io4ykP_aTNSWq.png", cAlternateFileName="5IO4YK~1.PNG")) returned 1 [0032.855] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5io4ykP_aTNSWq.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5io4ykp_atnswq.png")) returned 0x2020 [0032.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5io4ykP_aTNSWq.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5io4ykp_atnswq.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0032.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5io4ykP_aTNSWq.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5io4ykp_atnswq.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.856] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.857] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.858] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.858] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.858] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.858] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.858] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.858] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.859] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.859] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.859] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.859] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.859] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.859] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.859] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.860] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.860] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.860] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.860] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.860] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.860] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.861] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.861] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.861] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.861] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.861] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.861] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.861] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.862] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.862] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.862] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.862] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.862] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.863] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.863] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.863] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.863] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.863] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.863] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.863] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.864] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.864] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.864] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.864] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.864] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.864] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.864] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.865] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.865] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0xaf0, lpOverlapped=0x0) returned 1 [0032.865] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0xaf0, lpOverlapped=0x0) returned 1 [0032.865] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0032.865] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0032.865] CloseHandle (hObject=0xf4) returned 1 [0032.865] CloseHandle (hObject=0xf8) returned 1 [0032.867] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5io4ykP_aTNSWq.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5io4ykp_atnswq.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5io4ykP_aTNSWq.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5io4ykp_atnswq.png.crypt")) returned 0 [0032.867] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5io4ykP_aTNSWq.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5io4ykp_atnswq.png.crypt")) returned 0x2020 [0032.867] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5io4ykP_aTNSWq.png", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc5d822e0, ftCreationTime.dwHighDateTime=0x1d4cf95, ftLastAccessTime.dwLowDateTime=0x1c24f20, ftLastAccessTime.dwHighDateTime=0x1d4cd56, ftLastWriteTime.dwLowDateTime=0x1c24f20, ftLastWriteTime.dwHighDateTime=0x1d4cd56, nFileSizeHigh=0x0, nFileSizeLow=0x18af0, dwReserved0=0x5d0f20, dwReserved1=0x18f1a4, cFileName="5io4ykP_aTNSWq.png", cAlternateFileName="5IO4YK~1.PNG")) returned 0x5c8ec0 [0032.867] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc5d822e0, ftCreationTime.dwHighDateTime=0x1d4cf95, ftLastAccessTime.dwLowDateTime=0x1c24f20, ftLastAccessTime.dwHighDateTime=0x1d4cd56, ftLastWriteTime.dwLowDateTime=0x1c24f20, ftLastWriteTime.dwHighDateTime=0x1d4cd56, nFileSizeHigh=0x0, nFileSizeLow=0x18af0, dwReserved0=0x5d0f20, dwReserved1=0x18f1a4, cFileName="5io4ykP_aTNSWq.png", cAlternateFileName="5IO4YK~1.PNG")) returned 0 [0032.867] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.867] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5io4ykP_aTNSWq.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5io4ykp_atnswq.png")) returned 1 [0032.869] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\5io4ykP_aTNSWq.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\5io4ykp_atnswq.png")) returned 0xffffffff [0032.869] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ef54a70, ftCreationTime.dwHighDateTime=0x1d4cde1, ftLastAccessTime.dwLowDateTime=0x25716090, ftLastAccessTime.dwHighDateTime=0x1d4d1da, ftLastWriteTime.dwLowDateTime=0x25716090, ftLastWriteTime.dwHighDateTime=0x1d4d1da, nFileSizeHigh=0x0, nFileSizeLow=0x4db8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="80cAS.mp4", cAlternateFileName="")) returned 1 [0032.869] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x578bf760, ftCreationTime.dwHighDateTime=0x1d4d087, ftLastAccessTime.dwLowDateTime=0x94a50eb0, ftLastAccessTime.dwHighDateTime=0x1d4cb7e, ftLastWriteTime.dwLowDateTime=0x94a50eb0, ftLastWriteTime.dwHighDateTime=0x1d4cb7e, nFileSizeHigh=0x0, nFileSizeLow=0x14694, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="A4g9WOPgcu6O9s.gif", cAlternateFileName="A4G9WO~1.GIF")) returned 1 [0032.869] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8426eba0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x8426eba0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x842e0fc0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1 [0032.869] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77c66ea0, ftCreationTime.dwHighDateTime=0x1d4c7dd, ftLastAccessTime.dwLowDateTime=0x3bba0980, ftLastAccessTime.dwHighDateTime=0x1d4d2d2, ftLastWriteTime.dwLowDateTime=0x3bba0980, ftLastWriteTime.dwHighDateTime=0x1d4d2d2, nFileSizeHigh=0x0, nFileSizeLow=0xf49f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="aKzVa3IxuqL1.mp4", cAlternateFileName="AKZVA3~1.MP4")) returned 1 [0032.869] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf04e3ec0, ftCreationTime.dwHighDateTime=0x1d4cb57, ftLastAccessTime.dwLowDateTime=0xbfa28410, ftLastAccessTime.dwHighDateTime=0x1d4d035, ftLastWriteTime.dwLowDateTime=0xbfa28410, ftLastWriteTime.dwHighDateTime=0x1d4d035, nFileSizeHigh=0x0, nFileSizeLow=0x1613, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cFYt2wQ.doc", cAlternateFileName="")) returned 1 [0032.869] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x15f72850, ftCreationTime.dwHighDateTime=0x1d4cb92, ftLastAccessTime.dwLowDateTime=0x1da270c0, ftLastAccessTime.dwHighDateTime=0x1d4c93d, ftLastWriteTime.dwLowDateTime=0x1da270c0, ftLastWriteTime.dwHighDateTime=0x1d4c93d, nFileSizeHigh=0x0, nFileSizeLow=0xee5d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cl_UFtg4iNDKobgiu9i_.mp4", cAlternateFileName="CL_UFT~1.MP4")) returned 1 [0032.869] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Cookies", cAlternateFileName="")) returned 1 [0032.869] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0032.872] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.872] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0032.872] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0032.872] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.873] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8727a0c0, ftCreationTime.dwHighDateTime=0x1d4d3f0, ftLastAccessTime.dwLowDateTime=0x669ae950, ftLastAccessTime.dwHighDateTime=0x1d4cf3d, ftLastWriteTime.dwLowDateTime=0x669ae950, ftLastWriteTime.dwHighDateTime=0x1d4cf3d, nFileSizeHigh=0x0, nFileSizeLow=0x17439, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="FSO3fD2cQfhLURU.doc", cAlternateFileName="FSO3FD~1.DOC")) returned 1 [0032.873] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1 [0032.873] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 0x80 [0032.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0032.873] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0032.873] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0032.874] CloseHandle (hObject=0xf8) returned 1 [0032.874] CloseHandle (hObject=0xf4) returned 1 [0032.874] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt.crypt")) returned 0 [0032.874] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt.crypt")) returned 0x2020 [0032.874] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0f28, dwReserved1=0x18f1a4, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0x5c8ec0 [0032.874] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0f28, dwReserved1=0x18f1a4, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0 [0032.874] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.874] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 0 [0032.874] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 0x80 [0032.874] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa0317820, ftCreationTime.dwHighDateTime=0x1d4ca09, ftLastAccessTime.dwLowDateTime=0xc506dff0, ftLastAccessTime.dwHighDateTime=0x1d4c720, ftLastWriteTime.dwLowDateTime=0xc506dff0, ftLastWriteTime.dwHighDateTime=0x1d4c720, nFileSizeHigh=0x0, nFileSizeLow=0xfa05, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="GQKP.gif", cAlternateFileName="")) returned 1 [0032.874] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="History", cAlternateFileName="")) returned 1 [0032.874] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0032.875] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.875] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0032.875] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x460067, dwReserved1=0x6c0069, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.876] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x460067, dwReserved1=0x6c0069, cFileName="..", cAlternateFileName="")) returned 1 [0032.876] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x460067, dwReserved1=0x6c0069, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0032.876] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini")) returned 0x2006 [0032.876] VirtualAlloc (lpAddress=0x1fe4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe4000 [0032.876] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0032.876] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.877] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x91, lpOverlapped=0x0) returned 1 [0032.878] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x91, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x91, lpOverlapped=0x0) returned 1 [0032.879] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.879] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.879] CloseHandle (hObject=0xfc) returned 1 [0032.879] CloseHandle (hObject=0x108) returned 1 [0032.879] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini.crypt")) returned 0 [0032.879] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini.crypt")) returned 0x2020 [0032.880] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5d0e80, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0032.880] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5d0e80, dwReserved1=0x18ecd4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0032.880] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.880] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini")) returned 1 [0032.881] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\desktop.ini")) returned 0xffffffff [0032.881] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0032.881] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 0 [0032.881] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.881] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0032.881] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.881] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c2baa10, ftCreationTime.dwHighDateTime=0x1d4d1b3, ftLastAccessTime.dwLowDateTime=0x268a4cd0, ftLastAccessTime.dwHighDateTime=0x1d4c5b4, ftLastWriteTime.dwLowDateTime=0x268a4cd0, ftLastWriteTime.dwHighDateTime=0x1d4c5b4, nFileSizeHigh=0x0, nFileSizeLow=0x122bb, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="HjJiUsvBzzT.mkv", cAlternateFileName="HJJIUS~1.MKV")) returned 1 [0032.881] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b3c98b0, ftCreationTime.dwHighDateTime=0x1d4c982, ftLastAccessTime.dwLowDateTime=0x9297a5d0, ftLastAccessTime.dwHighDateTime=0x1d4d1fd, ftLastWriteTime.dwLowDateTime=0x9297a5d0, ftLastWriteTime.dwHighDateTime=0x1d4d1fd, nFileSizeHigh=0x0, nFileSizeLow=0xd4f6, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="iK-FSy.wav", cAlternateFileName="")) returned 1 [0032.881] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39602770, ftCreationTime.dwHighDateTime=0x1d4cbe1, ftLastAccessTime.dwLowDateTime=0xaff20ee0, ftLastAccessTime.dwHighDateTime=0x1d4d3d8, ftLastWriteTime.dwLowDateTime=0xaff20ee0, ftLastWriteTime.dwHighDateTime=0x1d4d3d8, nFileSizeHigh=0x0, nFileSizeLow=0xa8dc, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="jgMOzQNI.wav", cAlternateFileName="")) returned 1 [0032.881] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb3c67af0, ftCreationTime.dwHighDateTime=0x1d4c85d, ftLastAccessTime.dwLowDateTime=0x6ed57800, ftLastAccessTime.dwHighDateTime=0x1d4cd6d, ftLastWriteTime.dwLowDateTime=0x6ed57800, ftLastWriteTime.dwHighDateTime=0x1d4cd6d, nFileSizeHigh=0x0, nFileSizeLow=0x8a38, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="jriXj.m4a", cAlternateFileName="")) returned 1 [0032.881] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x32e07c20, ftCreationTime.dwHighDateTime=0x1d4c582, ftLastAccessTime.dwLowDateTime=0x66263f70, ftLastAccessTime.dwHighDateTime=0x1d4c7f3, ftLastWriteTime.dwLowDateTime=0x66263f70, ftLastWriteTime.dwHighDateTime=0x1d4c7f3, nFileSizeHigh=0x0, nFileSizeLow=0x7144, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="jtypR131TZE-LNfWN6F.jpg", cAlternateFileName="JTYPR1~1.JPG")) returned 1 [0032.881] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jtypR131TZE-LNfWN6F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jtypr131tze-lnfwn6f.jpg")) returned 0x2020 [0032.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jtypR131TZE-LNfWN6F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jtypr131tze-lnfwn6f.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0032.882] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jtypR131TZE-LNfWN6F.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jtypr131tze-lnfwn6f.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.882] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.883] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.884] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.884] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.884] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.884] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.884] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.884] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.885] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.885] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.885] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.885] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.885] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.885] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.885] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x144, lpOverlapped=0x0) returned 1 [0032.886] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x144, lpOverlapped=0x0) returned 1 [0032.886] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0032.886] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0032.886] CloseHandle (hObject=0xf4) returned 1 [0032.886] CloseHandle (hObject=0xf8) returned 1 [0032.887] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jtypR131TZE-LNfWN6F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jtypr131tze-lnfwn6f.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jtypR131TZE-LNfWN6F.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jtypr131tze-lnfwn6f.jpg.crypt")) returned 0 [0032.887] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jtypR131TZE-LNfWN6F.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jtypr131tze-lnfwn6f.jpg.crypt")) returned 0x2020 [0032.887] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jtypR131TZE-LNfWN6F.jpg", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x32e07c20, ftCreationTime.dwHighDateTime=0x1d4c582, ftLastAccessTime.dwLowDateTime=0x66263f70, ftLastAccessTime.dwHighDateTime=0x1d4c7f3, ftLastWriteTime.dwLowDateTime=0x66263f70, ftLastWriteTime.dwHighDateTime=0x1d4c7f3, nFileSizeHigh=0x0, nFileSizeLow=0x7144, dwReserved0=0x5d0f28, dwReserved1=0x18f1a4, cFileName="jtypR131TZE-LNfWN6F.jpg", cAlternateFileName="JTYPR1~1.JPG")) returned 0x5c8ec0 [0032.887] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x32e07c20, ftCreationTime.dwHighDateTime=0x1d4c582, ftLastAccessTime.dwLowDateTime=0x66263f70, ftLastAccessTime.dwHighDateTime=0x1d4c7f3, ftLastWriteTime.dwLowDateTime=0x66263f70, ftLastWriteTime.dwHighDateTime=0x1d4c7f3, nFileSizeHigh=0x0, nFileSizeLow=0x7144, dwReserved0=0x5d0f28, dwReserved1=0x18f1a4, cFileName="jtypR131TZE-LNfWN6F.jpg", cAlternateFileName="JTYPR1~1.JPG")) returned 0 [0032.887] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.887] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jtypR131TZE-LNfWN6F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jtypr131tze-lnfwn6f.jpg")) returned 1 [0032.888] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\jtypR131TZE-LNfWN6F.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\jtypr131tze-lnfwn6f.jpg")) returned 0xffffffff [0032.888] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c5e4890, ftCreationTime.dwHighDateTime=0x1d4cd42, ftLastAccessTime.dwLowDateTime=0xd60b7490, ftLastAccessTime.dwHighDateTime=0x1d4d301, ftLastWriteTime.dwLowDateTime=0xd60b7490, ftLastWriteTime.dwHighDateTime=0x1d4d301, nFileSizeHigh=0x0, nFileSizeLow=0x12b1a, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="KlhcpCy_.ods", cAlternateFileName="")) returned 1 [0032.888] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b1fc70, ftCreationTime.dwHighDateTime=0x1d4c958, ftLastAccessTime.dwLowDateTime=0xcc3fb580, ftLastAccessTime.dwHighDateTime=0x1d4cc34, ftLastWriteTime.dwLowDateTime=0xcc3fb580, ftLastWriteTime.dwHighDateTime=0x1d4cc34, nFileSizeHigh=0x0, nFileSizeLow=0x18c52, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="L4Mce_hTp5eSUCW.avi", cAlternateFileName="L4MCE_~1.AVI")) returned 1 [0032.888] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbba97d80, ftCreationTime.dwHighDateTime=0x1d4ce11, ftLastAccessTime.dwLowDateTime=0x132995a0, ftLastAccessTime.dwHighDateTime=0x1d4cf51, ftLastWriteTime.dwLowDateTime=0x132995a0, ftLastWriteTime.dwHighDateTime=0x1d4cf51, nFileSizeHigh=0x0, nFileSizeLow=0x15eff, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="N5uV0XPCzJXOHSAntFh7.xls", cAlternateFileName="N5UV0X~1.XLS")) returned 1 [0032.889] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9a1d550, ftCreationTime.dwHighDateTime=0x1d4cef6, ftLastAccessTime.dwLowDateTime=0xffdd66d0, ftLastAccessTime.dwHighDateTime=0x1d4cbc6, ftLastWriteTime.dwLowDateTime=0xffdd66d0, ftLastWriteTime.dwHighDateTime=0x1d4cbc6, nFileSizeHigh=0x0, nFileSizeLow=0x25fa, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="qKeV-bFPsfmfEIMA.gif", cAlternateFileName="QKEV-B~1.GIF")) returned 1 [0032.889] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2e6dab0, ftCreationTime.dwHighDateTime=0x1d4c7ec, ftLastAccessTime.dwLowDateTime=0x96896da0, ftLastAccessTime.dwHighDateTime=0x1d4c671, ftLastWriteTime.dwLowDateTime=0x96896da0, ftLastWriteTime.dwHighDateTime=0x1d4c671, nFileSizeHigh=0x0, nFileSizeLow=0x675f, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="S-GJZ6fQnIMuKjn4b.avi", cAlternateFileName="S-GJZ6~1.AVI")) returned 1 [0032.889] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28135610, ftCreationTime.dwHighDateTime=0x1d4ccc0, ftLastAccessTime.dwLowDateTime=0x5d84b150, ftLastAccessTime.dwHighDateTime=0x1d4ca62, ftLastWriteTime.dwLowDateTime=0x5d84b150, ftLastWriteTime.dwHighDateTime=0x1d4ca62, nFileSizeHigh=0x0, nFileSizeLow=0x9003, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="s8u20c35Qa.flv", cAlternateFileName="S8U20C~1.FLV")) returned 1 [0032.889] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbae45ee0, ftCreationTime.dwHighDateTime=0x1d4c765, ftLastAccessTime.dwLowDateTime=0x3903c350, ftLastAccessTime.dwHighDateTime=0x1d4c933, ftLastWriteTime.dwLowDateTime=0x3903c350, ftLastWriteTime.dwHighDateTime=0x1d4c933, nFileSizeHigh=0x0, nFileSizeLow=0x3c1b, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="sk21AT-eeuEaN0Sf1o.gif", cAlternateFileName="SK21AT~1.GIF")) returned 1 [0032.889] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x985d0680, ftCreationTime.dwHighDateTime=0x1d4c871, ftLastAccessTime.dwLowDateTime=0x6008b920, ftLastAccessTime.dwHighDateTime=0x1d4cd4c, ftLastWriteTime.dwLowDateTime=0x6008b920, ftLastWriteTime.dwHighDateTime=0x1d4cd4c, nFileSizeHigh=0x0, nFileSizeLow=0xfc42, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="So0-9GY-M-NF.flv", cAlternateFileName="SO0-9G~1.FLV")) returned 1 [0032.889] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0022e50, ftCreationTime.dwHighDateTime=0x1d4d4de, ftLastAccessTime.dwLowDateTime=0xbdbd3dc0, ftLastAccessTime.dwHighDateTime=0x1d4d2b0, ftLastWriteTime.dwLowDateTime=0xbdbd3dc0, ftLastWriteTime.dwHighDateTime=0x1d4d2b0, nFileSizeHigh=0x0, nFileSizeLow=0xb924, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="t9hkZDKT6mmn.png", cAlternateFileName="T9HKZD~1.PNG")) returned 1 [0032.889] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9hkZDKT6mmn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9hkzdkt6mmn.png")) returned 0x2020 [0032.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9hkZDKT6mmn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9hkzdkt6mmn.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9hkZDKT6mmn.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9hkzdkt6mmn.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0032.897] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.898] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.899] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.899] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.899] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.899] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.899] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.899] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.900] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.900] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.900] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.900] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.900] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.900] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.901] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.901] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.901] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.901] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.901] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.901] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.901] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.902] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.902] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x924, lpOverlapped=0x0) returned 1 [0032.902] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x924, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x924, lpOverlapped=0x0) returned 1 [0032.902] ReadFile (in: hFile=0xf8, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0032.902] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0032.902] CloseHandle (hObject=0xf8) returned 1 [0032.902] CloseHandle (hObject=0xf4) returned 1 [0032.903] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9hkZDKT6mmn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9hkzdkt6mmn.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9hkZDKT6mmn.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9hkzdkt6mmn.png.crypt")) returned 0 [0032.904] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9hkZDKT6mmn.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9hkzdkt6mmn.png.crypt")) returned 0x2020 [0032.904] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9hkZDKT6mmn.png", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0022e50, ftCreationTime.dwHighDateTime=0x1d4d4de, ftLastAccessTime.dwLowDateTime=0xbdbd3dc0, ftLastAccessTime.dwHighDateTime=0x1d4d2b0, ftLastWriteTime.dwLowDateTime=0xbdbd3dc0, ftLastWriteTime.dwHighDateTime=0x1d4d2b0, nFileSizeHigh=0x0, nFileSizeLow=0xb924, dwReserved0=0x5d0f18, dwReserved1=0x18f1a4, cFileName="t9hkZDKT6mmn.png", cAlternateFileName="T9HKZD~1.PNG")) returned 0x5c8ec0 [0032.904] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0022e50, ftCreationTime.dwHighDateTime=0x1d4d4de, ftLastAccessTime.dwLowDateTime=0xbdbd3dc0, ftLastAccessTime.dwHighDateTime=0x1d4d2b0, ftLastWriteTime.dwLowDateTime=0xbdbd3dc0, ftLastWriteTime.dwHighDateTime=0x1d4d2b0, nFileSizeHigh=0x0, nFileSizeLow=0xb924, dwReserved0=0x5d0f18, dwReserved1=0x18f1a4, cFileName="t9hkZDKT6mmn.png", cAlternateFileName="T9HKZD~1.PNG")) returned 0 [0032.904] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.904] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9hkZDKT6mmn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9hkzdkt6mmn.png")) returned 1 [0032.905] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\t9hkZDKT6mmn.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\t9hkzdkt6mmn.png")) returned 0xffffffff [0032.905] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0032.905] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0032.906] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.906] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0032.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e0070, dwReserved1=0x59580067, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.906] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e0070, dwReserved1=0x59580067, cFileName="..", cAlternateFileName="")) returned 1 [0032.906] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e0070, dwReserved1=0x59580067, cFileName="03J4UQW0", cAlternateFileName="")) returned 1 [0032.907] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.907] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.907] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0032.907] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini")) returned 0x2006 [0032.908] VirtualAlloc (lpAddress=0x1fe8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe8000 [0032.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0032.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.909] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0032.910] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0032.911] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0032.911] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0032.911] CloseHandle (hObject=0xfc) returned 1 [0032.911] CloseHandle (hObject=0x114) returned 1 [0032.911] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini.crypt")) returned 0 [0032.912] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini.crypt")) returned 0x2020 [0032.912] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0032.912] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0032.912] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.912] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini")) returned 1 [0032.913] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\desktop.ini")) returned 0xffffffff [0032.913] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0032.913] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.913] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x6e0070, dwReserved1=0x59580067, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0032.913] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini")) returned 0x2006 [0032.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0032.916] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0032.917] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0032.918] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.918] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0032.918] CloseHandle (hObject=0x108) returned 1 [0032.918] CloseHandle (hObject=0x114) returned 1 [0032.919] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini.crypt")) returned 0 [0032.919] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini.crypt")) returned 0x2020 [0032.919] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0032.919] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0032.919] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.919] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini")) returned 1 [0032.920] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\desktop.ini")) returned 0xffffffff [0032.920] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0032.920] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="KETAJP6D", cAlternateFileName="")) returned 1 [0032.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.920] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.920] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xc2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0032.920] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini")) returned 0x2006 [0032.921] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.921] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0032.921] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0032.922] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0032.923] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0032.923] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0032.923] CloseHandle (hObject=0x108) returned 1 [0032.923] CloseHandle (hObject=0xfc) returned 1 [0032.923] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini.crypt")) returned 0 [0032.923] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini.crypt")) returned 0x2020 [0032.923] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0032.924] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0032.924] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.924] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini")) returned 1 [0032.925] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\desktop.ini")) returned 0xffffffff [0032.925] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xc2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0032.925] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.925] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="VB18B0KB", cAlternateFileName="")) returned 1 [0032.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.925] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="..", cAlternateFileName="")) returned 1 [0032.925] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0032.925] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini")) returned 0x2006 [0032.925] VirtualAlloc (lpAddress=0x1fec000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fec000 [0032.926] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0032.926] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.926] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0032.927] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0032.928] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0032.928] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0032.928] CloseHandle (hObject=0xfc) returned 1 [0032.928] CloseHandle (hObject=0x108) returned 1 [0032.928] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini.crypt")) returned 0 [0032.929] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini.crypt")) returned 0x2020 [0032.929] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0032.929] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0032.929] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.929] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini")) returned 1 [0032.930] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\desktop.ini")) returned 0xffffffff [0032.930] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0032.930] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.930] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1 [0032.930] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.930] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="..", cAlternateFileName="")) returned 1 [0032.930] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0032.930] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini")) returned 0x2006 [0032.931] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0032.931] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0032.931] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0032.932] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0032.933] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0032.933] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0032.933] CloseHandle (hObject=0x108) returned 1 [0032.933] CloseHandle (hObject=0xfc) returned 1 [0032.933] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini.crypt")) returned 0 [0032.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini.crypt")) returned 0x2020 [0032.934] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0032.934] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0032.934] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.934] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini")) returned 1 [0032.935] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\desktop.ini")) returned 0xffffffff [0032.935] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0032.935] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.935] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0 [0032.935] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.935] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 0 [0032.935] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.935] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b865010, ftCreationTime.dwHighDateTime=0x1d4c954, ftLastAccessTime.dwLowDateTime=0x21f0cbf0, ftLastAccessTime.dwHighDateTime=0x1d4ced2, ftLastWriteTime.dwLowDateTime=0x21f0cbf0, ftLastWriteTime.dwHighDateTime=0x1d4ced2, nFileSizeHigh=0x0, nFileSizeLow=0x804a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="UfqKiEkYuwI93_-.swf", cAlternateFileName="UFQKIE~1.SWF")) returned 1 [0032.935] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe44454c0, ftCreationTime.dwHighDateTime=0x1d4cfe9, ftLastAccessTime.dwLowDateTime=0xb199df20, ftLastAccessTime.dwHighDateTime=0x1d4ca9b, ftLastWriteTime.dwLowDateTime=0xb199df20, ftLastWriteTime.dwHighDateTime=0x1d4ca9b, nFileSizeHigh=0x0, nFileSizeLow=0xb932, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="UgBzhl2WTYR9ESx_sq.m4a", cAlternateFileName="UGBZHL~1.M4A")) returned 1 [0032.935] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a1f0640, ftCreationTime.dwHighDateTime=0x1d4c9ee, ftLastAccessTime.dwLowDateTime=0x68ed4c00, ftLastAccessTime.dwHighDateTime=0x1d4d2e6, ftLastWriteTime.dwLowDateTime=0x68ed4c00, ftLastWriteTime.dwHighDateTime=0x1d4d2e6, nFileSizeHigh=0x0, nFileSizeLow=0x174d0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="uMHSWgHojvs17aqvFAe4.odp", cAlternateFileName="UMHSWG~1.ODP")) returned 1 [0032.935] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5829c3e0, ftCreationTime.dwHighDateTime=0x1d4c809, ftLastAccessTime.dwLowDateTime=0xc39a2c70, ftLastAccessTime.dwHighDateTime=0x1d4d509, ftLastWriteTime.dwLowDateTime=0xc39a2c70, ftLastWriteTime.dwHighDateTime=0x1d4d509, nFileSizeHigh=0x0, nFileSizeLow=0x93b5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="uNI3bAqcyPO.rtf", cAlternateFileName="UNI3BA~1.RTF")) returned 1 [0032.935] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4ff7a30, ftCreationTime.dwHighDateTime=0x1d4d164, ftLastAccessTime.dwLowDateTime=0x76e24df0, ftLastAccessTime.dwHighDateTime=0x1d4cfe5, ftLastWriteTime.dwLowDateTime=0x76e24df0, ftLastWriteTime.dwHighDateTime=0x1d4cfe5, nFileSizeHigh=0x0, nFileSizeLow=0x32be, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Vn1iq4oO4_DCn0Pz.gif", cAlternateFileName="VN1IQ4~1.GIF")) returned 1 [0032.935] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9d37abf0, ftCreationTime.dwHighDateTime=0x1d4c5de, ftLastAccessTime.dwLowDateTime=0x8fcbe9d0, ftLastAccessTime.dwHighDateTime=0x1d4d188, ftLastWriteTime.dwLowDateTime=0x8fcbe9d0, ftLastWriteTime.dwHighDateTime=0x1d4d188, nFileSizeHigh=0x0, nFileSizeLow=0xd74e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vnCsY2p-T0nHBKZ8D19.mp3", cAlternateFileName="VNCSY2~1.MP3")) returned 1 [0032.935] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x874c95a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x874c95a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WPDNSE", cAlternateFileName="")) returned 1 [0032.935] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x874c95a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x874c95a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0032.936] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x874c95a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x874c95a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.936] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x874c95a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x874c95a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771a1ecd, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.936] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.936] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ef6c140, ftCreationTime.dwHighDateTime=0x1d4d100, ftLastAccessTime.dwLowDateTime=0x412e5150, ftLastAccessTime.dwHighDateTime=0x1d4c643, ftLastWriteTime.dwLowDateTime=0x412e5150, ftLastWriteTime.dwHighDateTime=0x1d4c643, nFileSizeHigh=0x0, nFileSizeLow=0x6faf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="xm4-N-lSG2Dlt0AN.png", cAlternateFileName="XM4-N-~1.PNG")) returned 1 [0032.936] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xm4-N-lSG2Dlt0AN.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xm4-n-lsg2dlt0an.png")) returned 0x2020 [0032.937] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xm4-N-lSG2Dlt0AN.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xm4-n-lsg2dlt0an.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0032.937] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xm4-N-lSG2Dlt0AN.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xm4-n-lsg2dlt0an.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.937] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.938] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.939] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.939] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.939] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.939] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.940] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.940] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.940] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.940] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.941] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.941] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0032.941] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0xfaf, lpOverlapped=0x0) returned 1 [0032.941] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0xfaf, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0xfaf, lpOverlapped=0x0) returned 1 [0032.941] ReadFile (in: hFile=0xf4, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0032.941] WriteFile (in: hFile=0xf8, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0032.941] CloseHandle (hObject=0xf4) returned 1 [0032.941] CloseHandle (hObject=0xf8) returned 1 [0032.942] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xm4-N-lSG2Dlt0AN.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xm4-n-lsg2dlt0an.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xm4-N-lSG2Dlt0AN.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xm4-n-lsg2dlt0an.png.crypt")) returned 0 [0032.942] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xm4-N-lSG2Dlt0AN.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xm4-n-lsg2dlt0an.png.crypt")) returned 0x2020 [0032.943] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xm4-N-lSG2Dlt0AN.png", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ef6c140, ftCreationTime.dwHighDateTime=0x1d4d100, ftLastAccessTime.dwLowDateTime=0x412e5150, ftLastAccessTime.dwHighDateTime=0x1d4c643, ftLastWriteTime.dwLowDateTime=0x412e5150, ftLastWriteTime.dwHighDateTime=0x1d4c643, nFileSizeHigh=0x0, nFileSizeLow=0x6faf, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="xm4-N-lSG2Dlt0AN.png", cAlternateFileName="XM4-N-~1.PNG")) returned 0x5c8ec0 [0032.943] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ef6c140, ftCreationTime.dwHighDateTime=0x1d4d100, ftLastAccessTime.dwLowDateTime=0x412e5150, ftLastAccessTime.dwHighDateTime=0x1d4c643, ftLastWriteTime.dwLowDateTime=0x412e5150, ftLastWriteTime.dwHighDateTime=0x1d4c643, nFileSizeHigh=0x0, nFileSizeLow=0x6faf, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="xm4-N-lSG2Dlt0AN.png", cAlternateFileName="XM4-N-~1.PNG")) returned 0 [0032.943] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.943] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xm4-N-lSG2Dlt0AN.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xm4-n-lsg2dlt0an.png")) returned 1 [0032.946] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\xm4-N-lSG2Dlt0AN.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\xm4-n-lsg2dlt0an.png")) returned 0xffffffff [0032.946] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbebb9c90, ftCreationTime.dwHighDateTime=0x1d4c61b, ftLastAccessTime.dwLowDateTime=0x57482b60, ftLastAccessTime.dwHighDateTime=0x1d4d1aa, ftLastWriteTime.dwLowDateTime=0x57482b60, ftLastWriteTime.dwHighDateTime=0x1d4d1aa, nFileSizeHigh=0x0, nFileSizeLow=0x30a8, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="Xwvd.flv", cAlternateFileName="")) returned 1 [0032.946] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbebb9c90, ftCreationTime.dwHighDateTime=0x1d4c61b, ftLastAccessTime.dwLowDateTime=0x57482b60, ftLastAccessTime.dwHighDateTime=0x1d4d1aa, ftLastWriteTime.dwLowDateTime=0x57482b60, ftLastWriteTime.dwHighDateTime=0x1d4d1aa, nFileSizeHigh=0x0, nFileSizeLow=0x30a8, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="Xwvd.flv", cAlternateFileName="")) returned 0 [0032.946] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0032.946] FindNextFileA (in: hFindFile=0x5c5cf8, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e702e4e, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0032.947] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbebb9c90, ftCreationTime.dwHighDateTime=0x1d4c61b, ftLastAccessTime.dwLowDateTime=0x57482b60, ftLastAccessTime.dwHighDateTime=0x1d4d1aa, ftLastWriteTime.dwLowDateTime=0x57482b60, ftLastWriteTime.dwHighDateTime=0x1d4d1aa, nFileSizeHigh=0x0, nFileSizeLow=0x30a8, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="Xwvd.flv", cAlternateFileName="\xf8\x5c\x5c")) returned 0xffffffff [0032.947] FindNextFileA (in: hFindFile=0x5c5cf8, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e702e4e, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0032.947] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0032.947] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="..", cAlternateFileName="")) returned 1 [0032.947] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="..", cAlternateFileName="")) returned 0 [0032.947] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0032.947] FindNextFileA (in: hFindFile=0x5c5cf8, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e702e4e, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0032.947] FindClose (in: hFindFile=0x5c5cf8 | out: hFindFile=0x5c5cf8) returned 1 [0032.947] FindNextFileA (in: hFindFile=0x5c5d58, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0032.947] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e702e4e, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0032.948] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e702e4e, cFileName="..", cAlternateFileName="")) returned 1 [0032.948] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e702e4e, cFileName="Adobe", cAlternateFileName="")) returned 1 [0032.948] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0032.948] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="..", cAlternateFileName="")) returned 1 [0032.948] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0032.949] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.949] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.949] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0032.949] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.950] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.950] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1 [0032.950] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce824760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce824760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe5ab8070, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1 [0032.950] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0032.950] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.951] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.951] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.951] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.951] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 0 [0032.951] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.951] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0032.952] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.952] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0032.952] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736567, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.952] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736567, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.952] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736567, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0032.952] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.953] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.953] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0032.953] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.954] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.954] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="all", cAlternateFileName="")) returned 1 [0032.954] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.955] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.955] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.955] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.955] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brt", cAlternateFileName="")) returned 1 [0032.955] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.956] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.956] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.956] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.956] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brz", cAlternateFileName="")) returned 1 [0032.956] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.957] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.957] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.957] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.957] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dan", cAlternateFileName="")) returned 1 [0032.957] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.957] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.957] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.957] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.957] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dut", cAlternateFileName="")) returned 1 [0032.958] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.958] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.958] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.958] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.958] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eng", cAlternateFileName="")) returned 1 [0032.958] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.958] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.958] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.958] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.959] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="frn", cAlternateFileName="")) returned 1 [0032.959] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.959] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.959] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.959] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.959] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="grm", cAlternateFileName="")) returned 1 [0032.959] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.959] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.959] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.959] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.959] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="itl", cAlternateFileName="")) returned 1 [0032.959] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.960] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.960] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.960] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.960] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrw", cAlternateFileName="")) returned 1 [0032.960] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.960] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.960] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.960] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.960] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prt", cAlternateFileName="")) returned 1 [0032.960] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.961] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.961] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.961] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.961] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="spn", cAlternateFileName="")) returned 1 [0032.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.961] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.961] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.961] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.961] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 1 [0032.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.962] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.962] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.962] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.962] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 0 [0032.962] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.962] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 0 [0032.962] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.962] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x736567, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0032.962] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.962] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18f13c, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0032.962] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.962] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e702e4e, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0032.962] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e73, dwReserved1=0x18f13c, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0032.962] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e73, dwReserved1=0x18f13c, cFileName="..", cAlternateFileName="")) returned 1 [0032.962] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e73, dwReserved1=0x18f13c, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0032.962] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6944206d, dwReserved1=0x6f697463, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.963] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6944206d, dwReserved1=0x6f697463, cFileName="..", cAlternateFileName="")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6944206d, dwReserved1=0x6f697463, cFileName="Content", cAlternateFileName="")) returned 1 [0032.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x0, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0032.963] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0032.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x0, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0x0, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0032.965] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="MetaData", cAlternateFileName="")) returned 1 [0032.965] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x0, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0032.965] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x0, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd48e2bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x611ea800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x611ea800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5836df00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5836df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0x0, dwReserved1=0x0, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf0dd70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0032.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x0, dwReserved1=0x0, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0032.967] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="MetaData", cAlternateFileName="")) returned 0 [0032.967] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.967] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e73, dwReserved1=0x18f13c, cFileName="IME12", cAlternateFileName="")) returned 1 [0032.967] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.968] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0032.968] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 0 [0032.968] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.969] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e73, dwReserved1=0x18f13c, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0032.969] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.969] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0032.969] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 0 [0032.969] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.969] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e73, dwReserved1=0x18f13c, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0032.969] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.969] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0032.969] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 0 [0032.969] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.970] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e73, dwReserved1=0x18f13c, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0032.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.970] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0032.970] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 0 [0032.970] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.970] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e73, dwReserved1=0x18f13c, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0032.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.971] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0032.971] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0032.971] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.971] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.972] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="36USA68T", cAlternateFileName="")) returned 1 [0032.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.972] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.972] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 1 [0032.972] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0 [0032.972] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.972] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f697469, dwReserved1=0x5d315b6e, cFileName="3O75JDME", cAlternateFileName="")) returned 1 [0032.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.973] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.973] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 1 [0032.973] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0 [0032.973] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.973] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x782e5d31, dwReserved1=0x5d316c6d, cFileName="index.dat", cAlternateFileName="")) returned 1 [0032.973] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x782e5d31, dwReserved1=0x5d316c6d, cFileName="UV0DUWVB", cAlternateFileName="")) returned 1 [0032.973] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.974] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.974] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.974] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.974] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x782e5d31, dwReserved1=0x5d316c6d, cFileName="VGMTOI09", cAlternateFileName="")) returned 1 [0032.974] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.974] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.974] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 1 [0032.974] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x0, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0 [0032.974] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.974] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x782e5d31, dwReserved1=0x5d316c6d, cFileName="VGMTOI09", cAlternateFileName="")) returned 0 [0032.974] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.974] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="Services", cAlternateFileName="")) returned 1 [0032.974] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x786c6d78, dwReserved1=0x5d316c6d, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.975] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x786c6d78, dwReserved1=0x5d316c6d, cFileName="..", cAlternateFileName="")) returned 1 [0032.975] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x786c6d78, dwReserved1=0x5d316c6d, cFileName="..", cAlternateFileName="")) returned 0 [0032.975] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.975] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="Services", cAlternateFileName="")) returned 0 [0032.976] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.976] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e73, dwReserved1=0x18f13c, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0 [0032.976] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.976] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6e707265, cFileName="Sun", cAlternateFileName="")) returned 1 [0032.976] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e73, dwReserved1=0x18f13c, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0032.977] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e73, dwReserved1=0x18f13c, cFileName="..", cAlternateFileName="")) returned 1 [0032.977] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e73, dwReserved1=0x18f13c, cFileName="Java", cAlternateFileName="")) returned 1 [0032.977] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0032.977] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0032.978] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="AU", cAlternateFileName="")) returned 1 [0032.978] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.978] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.978] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0x0, dwReserved1=0x0, cFileName="au.cab", cAlternateFileName="")) returned 1 [0032.978] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 1 [0032.978] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="au.msi", cAlternateFileName="")) returned 0 [0032.978] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.978] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0032.978] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.979] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.979] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 1 [0032.979] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0032.979] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.980] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.980] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0032.980] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.980] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tmp", cAlternateFileName="")) returned 1 [0032.980] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0032.980] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0032.980] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0032.980] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0032.981] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0032.981] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0032.981] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0032.982] VirtualAlloc (lpAddress=0x1ff0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ff0000 [0032.982] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0032.982] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0032.982] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.983] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0032.983] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x951cc660, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x951cc660, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6e707265, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0032.983] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\00EdcFm8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\00edcfm8.png")) returned 0x2020 [0032.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\00EdcFm8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\00edcfm8.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0032.983] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\00EdcFm8.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\00edcfm8.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.984] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.985] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.986] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.986] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.986] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.986] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.986] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.986] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.987] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.987] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.987] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.987] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.987] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.987] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.987] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.988] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.988] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.988] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.988] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.988] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.988] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.989] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.989] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xe71, lpOverlapped=0x0) returned 1 [0032.989] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xe71, lpOverlapped=0x0) returned 1 [0032.989] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0032.989] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0032.989] CloseHandle (hObject=0xf0) returned 1 [0032.989] CloseHandle (hObject=0xf8) returned 1 [0032.991] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\00EdcFm8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\00edcfm8.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\00EdcFm8.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\00edcfm8.png.crypt")) returned 0 [0032.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\00EdcFm8.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\00edcfm8.png.crypt")) returned 0x2020 [0032.991] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\00EdcFm8.png", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x20519450, ftCreationTime.dwHighDateTime=0x1d4cea5, ftLastAccessTime.dwLowDateTime=0xa90adc90, ftLastAccessTime.dwHighDateTime=0x1d4d376, ftLastWriteTime.dwLowDateTime=0xa90adc90, ftLastWriteTime.dwHighDateTime=0x1d4d376, nFileSizeHigh=0x0, nFileSizeLow=0xbe71, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="00EdcFm8.png", cAlternateFileName="")) returned 0x5c8ec0 [0032.991] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x20519450, ftCreationTime.dwHighDateTime=0x1d4cea5, ftLastAccessTime.dwLowDateTime=0xa90adc90, ftLastAccessTime.dwHighDateTime=0x1d4d376, ftLastWriteTime.dwLowDateTime=0xa90adc90, ftLastWriteTime.dwHighDateTime=0x1d4d376, nFileSizeHigh=0x0, nFileSizeLow=0xbe71, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="00EdcFm8.png", cAlternateFileName="")) returned 0 [0032.991] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.991] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\00EdcFm8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\00edcfm8.png")) returned 1 [0032.993] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\00EdcFm8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\00edcfm8.png")) returned 0xffffffff [0032.993] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6e4cc50, ftCreationTime.dwHighDateTime=0x1d4ce67, ftLastAccessTime.dwLowDateTime=0x183da0d0, ftLastAccessTime.dwHighDateTime=0x1d4d5a1, ftLastWriteTime.dwLowDateTime=0x183da0d0, ftLastWriteTime.dwHighDateTime=0x1d4d5a1, nFileSizeHigh=0x0, nFileSizeLow=0x3630, dwReserved0=0x0, dwReserved1=0x0, cFileName="0AXJYT.png", cAlternateFileName="")) returned 1 [0032.993] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0AXJYT.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0axjyt.png")) returned 0x2020 [0032.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0AXJYT.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0axjyt.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0032.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0AXJYT.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0axjyt.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0032.993] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.994] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.995] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.995] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.995] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.995] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0032.996] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x630, lpOverlapped=0x0) returned 1 [0032.996] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x630, lpOverlapped=0x0) returned 1 [0032.996] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0032.996] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0032.996] CloseHandle (hObject=0xf8) returned 1 [0032.996] CloseHandle (hObject=0xf0) returned 1 [0032.997] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0AXJYT.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0axjyt.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0AXJYT.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0axjyt.png.crypt")) returned 0 [0032.997] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0AXJYT.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0axjyt.png.crypt")) returned 0x2020 [0032.997] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0AXJYT.png", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6e4cc50, ftCreationTime.dwHighDateTime=0x1d4ce67, ftLastAccessTime.dwLowDateTime=0x183da0d0, ftLastAccessTime.dwHighDateTime=0x1d4d5a1, ftLastWriteTime.dwLowDateTime=0x183da0d0, ftLastWriteTime.dwHighDateTime=0x1d4d5a1, nFileSizeHigh=0x0, nFileSizeLow=0x3630, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="0AXJYT.png", cAlternateFileName="")) returned 0x5c8ec0 [0032.997] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf6e4cc50, ftCreationTime.dwHighDateTime=0x1d4ce67, ftLastAccessTime.dwLowDateTime=0x183da0d0, ftLastAccessTime.dwHighDateTime=0x1d4d5a1, ftLastWriteTime.dwLowDateTime=0x183da0d0, ftLastWriteTime.dwHighDateTime=0x1d4d5a1, nFileSizeHigh=0x0, nFileSizeLow=0x3630, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="0AXJYT.png", cAlternateFileName="")) returned 0 [0032.997] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0032.997] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0AXJYT.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0axjyt.png")) returned 1 [0032.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\0AXJYT.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\0axjyt.png")) returned 0xffffffff [0032.998] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2980da0, ftCreationTime.dwHighDateTime=0x1d4c634, ftLastAccessTime.dwLowDateTime=0x382526c0, ftLastAccessTime.dwHighDateTime=0x1d4cd9f, ftLastWriteTime.dwLowDateTime=0x382526c0, ftLastWriteTime.dwHighDateTime=0x1d4cd9f, nFileSizeHigh=0x0, nFileSizeLow=0x2125, dwReserved0=0x0, dwReserved1=0x0, cFileName="1lg2N.swf", cAlternateFileName="")) returned 1 [0032.998] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c21460, ftCreationTime.dwHighDateTime=0x1d4c956, ftLastAccessTime.dwLowDateTime=0x7411df60, ftLastAccessTime.dwHighDateTime=0x1d4c80f, ftLastWriteTime.dwLowDateTime=0x7411df60, ftLastWriteTime.dwHighDateTime=0x1d4c80f, nFileSizeHigh=0x0, nFileSizeLow=0x40ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="6XhrqzP.png", cAlternateFileName="")) returned 1 [0032.998] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6XhrqzP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6xhrqzp.png")) returned 0x2020 [0032.998] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6XhrqzP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6xhrqzp.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0032.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6XhrqzP.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6xhrqzp.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0033.002] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.002] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.003] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.004] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.004] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.004] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.004] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.004] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.004] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xac, lpOverlapped=0x0) returned 1 [0033.004] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xac, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xac, lpOverlapped=0x0) returned 1 [0033.005] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0033.005] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0033.005] CloseHandle (hObject=0xf0) returned 1 [0033.005] CloseHandle (hObject=0xf8) returned 1 [0033.006] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6XhrqzP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6xhrqzp.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6XhrqzP.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6xhrqzp.png.crypt")) returned 0 [0033.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6XhrqzP.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6xhrqzp.png.crypt")) returned 0x2020 [0033.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6XhrqzP.png", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c21460, ftCreationTime.dwHighDateTime=0x1d4c956, ftLastAccessTime.dwLowDateTime=0x7411df60, ftLastAccessTime.dwHighDateTime=0x1d4c80f, ftLastWriteTime.dwLowDateTime=0x7411df60, ftLastWriteTime.dwHighDateTime=0x1d4c80f, nFileSizeHigh=0x0, nFileSizeLow=0x40ac, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="6XhrqzP.png", cAlternateFileName="")) returned 0x5c8ec0 [0033.006] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55c21460, ftCreationTime.dwHighDateTime=0x1d4c956, ftLastAccessTime.dwLowDateTime=0x7411df60, ftLastAccessTime.dwHighDateTime=0x1d4c80f, ftLastWriteTime.dwLowDateTime=0x7411df60, ftLastWriteTime.dwHighDateTime=0x1d4c80f, nFileSizeHigh=0x0, nFileSizeLow=0x40ac, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="6XhrqzP.png", cAlternateFileName="")) returned 0 [0033.006] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0033.006] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6XhrqzP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6xhrqzp.png")) returned 1 [0033.007] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6XhrqzP.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6xhrqzp.png")) returned 0xffffffff [0033.007] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbbf4770, ftCreationTime.dwHighDateTime=0x1d4d101, ftLastAccessTime.dwLowDateTime=0x89124b30, ftLastAccessTime.dwHighDateTime=0x1d4ccc8, ftLastWriteTime.dwLowDateTime=0x89124b30, ftLastWriteTime.dwHighDateTime=0x1d4ccc8, nFileSizeHigh=0x0, nFileSizeLow=0x11e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="9IQcq xw6DsLpZv.swf", cAlternateFileName="9IQCQX~1.SWF")) returned 1 [0033.007] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0033.007] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0033.009] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.009] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0033.009] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.010] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName="..", cAlternateFileName="")) returned 1 [0033.010] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName="10.0", cAlternateFileName="")) returned 1 [0033.010] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.010] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.010] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1 [0033.010] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.011] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.011] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.011] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.011] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Forms", cAlternateFileName="")) returned 1 [0033.011] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.011] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.011] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.011] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.011] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1 [0033.011] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.012] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.012] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.js", cAlternateFileName="")) returned 1 [0033.012] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 1 [0033.012] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0 [0033.012] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.012] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6a2e7367, dwReserved1=0x73, cFileName="Security", cAlternateFileName="")) returned 1 [0033.012] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.012] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.012] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x0, dwReserved1=0x0, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0033.012] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0033.012] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0033.013] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.013] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefc97c0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", cAlternateFileName="48B764~1.CRL")) returned 1 [0033.013] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 1 [0033.013] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 0 [0033.013] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.013] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 0 [0033.013] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.013] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6a2e7367, dwReserved1=0x73, cFileName="Security", cAlternateFileName="")) returned 0 [0033.014] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.014] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName="10.0", cAlternateFileName="")) returned 0 [0033.014] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.014] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0033.014] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.015] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName="..", cAlternateFileName="")) returned 1 [0033.015] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0033.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.015] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="..", cAlternateFileName="")) returned 1 [0033.015] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1 [0033.015] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.016] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.016] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.016] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.016] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="D5NTRC6R", cAlternateFileName="")) returned 0 [0033.016] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.016] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 0 [0033.016] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.016] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0033.016] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.017] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName="..", cAlternateFileName="")) returned 1 [0033.017] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName="..", cAlternateFileName="")) returned 0 [0033.017] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.017] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0033.017] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.017] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName="..", cAlternateFileName="")) returned 1 [0033.017] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0033.017] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.017] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="..", cAlternateFileName="")) returned 1 [0033.017] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7263612e, dwReserved1=0x7461646f, cFileName="..", cAlternateFileName="")) returned 0 [0033.017] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.018] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0033.018] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.018] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0033.018] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.018] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName="..", cAlternateFileName="")) returned 1 [0033.018] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32d6f2e0, dwReserved1=0xfd38630c, cFileName="..", cAlternateFileName="")) returned 0 [0033.018] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.018] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0 [0033.018] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0033.018] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb61a20, ftCreationTime.dwHighDateTime=0x1d4c959, ftLastAccessTime.dwLowDateTime=0x4a385df0, ftLastAccessTime.dwHighDateTime=0x1d4c584, ftLastWriteTime.dwLowDateTime=0x4a385df0, ftLastWriteTime.dwHighDateTime=0x1d4c584, nFileSizeHigh=0x0, nFileSizeLow=0xfec7, dwReserved0=0x3274, dwReserved1=0x0, cFileName="bhUHT.jpg", cAlternateFileName="")) returned 1 [0033.019] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bhUHT.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bhuht.jpg")) returned 0x2020 [0033.019] VirtualAlloc (lpAddress=0x1ff4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ff4000 [0033.019] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bhUHT.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bhuht.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0033.019] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bhUHT.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bhuht.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0033.019] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.020] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.021] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.021] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.022] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.022] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.022] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.022] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.022] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.022] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.022] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.023] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.023] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.023] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.023] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.023] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.023] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.023] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.024] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.024] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.024] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.024] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.024] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.024] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.025] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.025] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.025] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.025] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.025] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.025] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.025] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xec7, lpOverlapped=0x0) returned 1 [0033.026] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xec7, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xec7, lpOverlapped=0x0) returned 1 [0033.026] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0033.026] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0033.026] CloseHandle (hObject=0xf8) returned 1 [0033.026] CloseHandle (hObject=0xf0) returned 1 [0033.027] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bhUHT.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bhuht.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bhUHT.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bhuht.jpg.crypt")) returned 0 [0033.027] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bhUHT.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bhuht.jpg.crypt")) returned 0x2020 [0033.027] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bhUHT.jpg", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb61a20, ftCreationTime.dwHighDateTime=0x1d4c959, ftLastAccessTime.dwLowDateTime=0x4a385df0, ftLastAccessTime.dwHighDateTime=0x1d4c584, ftLastWriteTime.dwLowDateTime=0x4a385df0, ftLastWriteTime.dwHighDateTime=0x1d4c584, nFileSizeHigh=0x0, nFileSizeLow=0xfec7, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="bhUHT.jpg", cAlternateFileName="")) returned 0x5c8ec0 [0033.027] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb61a20, ftCreationTime.dwHighDateTime=0x1d4c959, ftLastAccessTime.dwLowDateTime=0x4a385df0, ftLastAccessTime.dwHighDateTime=0x1d4c584, ftLastWriteTime.dwLowDateTime=0x4a385df0, ftLastWriteTime.dwHighDateTime=0x1d4c584, nFileSizeHigh=0x0, nFileSizeLow=0xfec7, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="bhUHT.jpg", cAlternateFileName="")) returned 0 [0033.027] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0033.028] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bhUHT.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bhuht.jpg")) returned 1 [0033.029] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\bhUHT.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\bhuht.jpg")) returned 0xffffffff [0033.029] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaa8c470, ftCreationTime.dwHighDateTime=0x1d4cc17, ftLastAccessTime.dwLowDateTime=0x3781f530, ftLastAccessTime.dwHighDateTime=0x1d4d52f, ftLastWriteTime.dwLowDateTime=0x3781f530, ftLastWriteTime.dwHighDateTime=0x1d4d52f, nFileSizeHigh=0x0, nFileSizeLow=0x9a2a, dwReserved0=0x5d0e78, dwReserved1=0x18f3a4, cFileName="D0zcRpw_caOcZNoV4mkG.png", cAlternateFileName="D0ZCRP~1.PNG")) returned 1 [0033.029] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\D0zcRpw_caOcZNoV4mkG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d0zcrpw_caocznov4mkg.png")) returned 0x2020 [0033.029] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\D0zcRpw_caOcZNoV4mkG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d0zcrpw_caocznov4mkg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0033.029] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\D0zcRpw_caOcZNoV4mkG.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d0zcrpw_caocznov4mkg.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0033.030] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.031] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.031] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.032] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.032] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.032] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.032] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.032] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.032] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.033] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.033] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.033] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.033] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.033] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.033] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.033] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.034] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.034] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0033.034] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xa2a, lpOverlapped=0x0) returned 1 [0033.034] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xa2a, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xa2a, lpOverlapped=0x0) returned 1 [0033.034] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0033.034] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0033.034] CloseHandle (hObject=0xf0) returned 1 [0033.035] CloseHandle (hObject=0xf8) returned 1 [0033.035] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\D0zcRpw_caOcZNoV4mkG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d0zcrpw_caocznov4mkg.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\D0zcRpw_caOcZNoV4mkG.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d0zcrpw_caocznov4mkg.png.crypt")) returned 0 [0033.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\D0zcRpw_caOcZNoV4mkG.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d0zcrpw_caocznov4mkg.png.crypt")) returned 0x2020 [0033.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\D0zcRpw_caOcZNoV4mkG.png", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaa8c470, ftCreationTime.dwHighDateTime=0x1d4cc17, ftLastAccessTime.dwLowDateTime=0x3781f530, ftLastAccessTime.dwHighDateTime=0x1d4d52f, ftLastWriteTime.dwLowDateTime=0x3781f530, ftLastWriteTime.dwHighDateTime=0x1d4d52f, nFileSizeHigh=0x0, nFileSizeLow=0x9a2a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="D0zcRpw_caOcZNoV4mkG.png", cAlternateFileName="D0ZCRP~1.PNG")) returned 0x5c8ec0 [0033.036] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaa8c470, ftCreationTime.dwHighDateTime=0x1d4cc17, ftLastAccessTime.dwLowDateTime=0x3781f530, ftLastAccessTime.dwHighDateTime=0x1d4d52f, ftLastWriteTime.dwLowDateTime=0x3781f530, ftLastWriteTime.dwHighDateTime=0x1d4d52f, nFileSizeHigh=0x0, nFileSizeLow=0x9a2a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="D0zcRpw_caOcZNoV4mkG.png", cAlternateFileName="D0ZCRP~1.PNG")) returned 0 [0033.036] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0033.036] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\D0zcRpw_caOcZNoV4mkG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d0zcrpw_caocznov4mkg.png")) returned 1 [0033.037] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\D0zcRpw_caOcZNoV4mkG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d0zcrpw_caocznov4mkg.png")) returned 0xffffffff [0033.037] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf87a0940, ftCreationTime.dwHighDateTime=0x1d4cd1d, ftLastAccessTime.dwLowDateTime=0x1e17b6c0, ftLastAccessTime.dwHighDateTime=0x1d4cf9e, ftLastWriteTime.dwLowDateTime=0x1e17b6c0, ftLastWriteTime.dwHighDateTime=0x1d4cf9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb6b, dwReserved0=0x5d0e78, dwReserved1=0x18f3a4, cFileName="eMhUXRXBgUglxcn3.bmp", cAlternateFileName="EMHUXR~1.BMP")) returned 1 [0033.037] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe6eaf70, ftCreationTime.dwHighDateTime=0x1d4d06b, ftLastAccessTime.dwLowDateTime=0x9a4d6180, ftLastAccessTime.dwHighDateTime=0x1d4cc66, ftLastWriteTime.dwLowDateTime=0x9a4d6180, ftLastWriteTime.dwHighDateTime=0x1d4cc66, nFileSizeHigh=0x0, nFileSizeLow=0x6138, dwReserved0=0x5d0e78, dwReserved1=0x18f3a4, cFileName="FEq4-A1qhZz_4.bmp", cAlternateFileName="FEQ4-A~1.BMP")) returned 1 [0033.037] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18f3a4, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0033.037] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0033.038] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.038] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0033.038] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.038] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName="..", cAlternateFileName="")) returned 1 [0033.038] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName="..", cAlternateFileName="")) returned 0 [0033.038] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.038] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0033.038] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0033.038] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3b473ea0, ftCreationTime.dwHighDateTime=0x1d4cf5d, ftLastAccessTime.dwLowDateTime=0x4153c710, ftLastAccessTime.dwHighDateTime=0x1d4cc4b, ftLastWriteTime.dwLowDateTime=0x4153c710, ftLastWriteTime.dwHighDateTime=0x1d4cc4b, nFileSizeHigh=0x0, nFileSizeLow=0x5501, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="J3ZkluwvkiGXI8r-B5.odp", cAlternateFileName="J3ZKLU~1.ODP")) returned 1 [0033.038] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a2cbb90, ftCreationTime.dwHighDateTime=0x1d4cd68, ftLastAccessTime.dwLowDateTime=0xe37d17f0, ftLastAccessTime.dwHighDateTime=0x1d4cf4b, ftLastWriteTime.dwLowDateTime=0xe37d17f0, ftLastWriteTime.dwHighDateTime=0x1d4cf4b, nFileSizeHigh=0x0, nFileSizeLow=0x4833, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="KogUT5xtVfTznY5.wav", cAlternateFileName="KOGUT5~1.WAV")) returned 1 [0033.038] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcba4810, ftCreationTime.dwHighDateTime=0x1d4c7c0, ftLastAccessTime.dwLowDateTime=0xaf62d4a0, ftLastAccessTime.dwHighDateTime=0x1d4d2cf, ftLastWriteTime.dwLowDateTime=0xaf62d4a0, ftLastWriteTime.dwHighDateTime=0x1d4d2cf, nFileSizeHigh=0x0, nFileSizeLow=0x15c4b, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="lAQFBeUeHy.gif", cAlternateFileName="LAQFBE~1.GIF")) returned 1 [0033.038] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0033.038] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0033.039] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.039] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0033.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.039] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName="..", cAlternateFileName="")) returned 1 [0033.039] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0033.039] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.040] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.040] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0033.040] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.041] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.041] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.041] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.041] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0 [0033.041] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.042] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0033.042] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.042] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.042] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1 [0033.042] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.043] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.043] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0033.043] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0033.043] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.044] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 1 [0033.044] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0033.044] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.044] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 1 [0033.044] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 0 [0033.044] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0033.044] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sys", cAlternateFileName="")) returned 0 [0033.044] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.044] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 0 [0033.044] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.044] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 0 [0033.044] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.045] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0033.045] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.045] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0033.045] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0033.045] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d333272, dwReserved1=0x45434334, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0033.045] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0033.045] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.045] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1 [0033.045] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.046] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName="..", cAlternateFileName="")) returned 1 [0033.046] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName="..", cAlternateFileName="")) returned 0 [0033.046] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.046] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0033.046] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.046] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName="..", cAlternateFileName="")) returned 1 [0033.047] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName="..", cAlternateFileName="")) returned 0 [0033.047] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.047] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0033.047] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.047] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName="..", cAlternateFileName="")) returned 1 [0033.047] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName="RSA", cAlternateFileName="")) returned 1 [0033.047] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.048] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.048] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0033.048] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.183] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.183] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xa1e34990, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="83AA4C~1")) returned 1 [0033.183] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x0, dwReserved1=0x0, cFileName="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="932A2D~1")) returned 1 [0033.183] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 1 [0033.183] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 0 [0033.184] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.184] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0033.184] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.185] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f004e, dwReserved1=0x340056, cFileName="RSA", cAlternateFileName="")) returned 0 [0033.185] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.185] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0033.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.185] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0033.185] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="1033", cAlternateFileName="")) returned 1 [0033.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37396634, dwReserved1=0x34383465, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.186] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37396634, dwReserved1=0x34383465, cFileName="..", cAlternateFileName="")) returned 1 [0033.186] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37396634, dwReserved1=0x34383465, cFileName="14", cAlternateFileName="")) returned 1 [0033.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.189] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.189] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0033.189] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0 [0033.189] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.189] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37396634, dwReserved1=0x34383465, cFileName="14", cAlternateFileName="")) returned 0 [0033.189] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.189] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="1033", cAlternateFileName="")) returned 0 [0033.190] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.190] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1 [0033.190] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.190] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0033.190] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0033.190] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.191] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="..", cAlternateFileName="")) returned 1 [0033.191] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="..", cAlternateFileName="")) returned 0 [0033.191] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.191] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0033.191] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.191] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1 [0033.191] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.191] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0033.191] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 0 [0033.191] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.192] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0033.192] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.192] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0033.192] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 0 [0033.192] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.192] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0033.192] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.193] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0033.193] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 0 [0033.193] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.193] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0033.193] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.193] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0033.193] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 0 [0033.193] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.193] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f63, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0033.194] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.194] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="..", cAlternateFileName="")) returned 1 [0033.194] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0033.194] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.194] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbda554a0, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbda554a0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="..", cAlternateFileName="")) returned 1 [0033.194] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.194] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 0x6 [0033.194] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.194] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.195] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xdd, lpOverlapped=0x0) returned 1 [0033.195] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xdd, lpOverlapped=0x0) returned 1 [0033.196] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.196] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.196] CloseHandle (hObject=0x114) returned 1 [0033.196] CloseHandle (hObject=0xfc) returned 1 [0033.198] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.crypt")) returned 0 [0033.198] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.crypt")) returned 0x20 [0033.198] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0033.198] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4eb35ad0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.198] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.198] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 1 [0033.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 0xffffffff [0033.199] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0033.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk")) returned 0x20 [0033.199] VirtualAlloc (lpAddress=0x1ff8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ff8000 [0033.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.200] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.201] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x8e9, lpOverlapped=0x0) returned 1 [0033.202] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x8e9, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x8e9, lpOverlapped=0x0) returned 1 [0033.203] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.203] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.203] CloseHandle (hObject=0xfc) returned 1 [0033.203] CloseHandle (hObject=0x114) returned 1 [0033.204] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.crypt")) returned 0 [0033.204] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.crypt")) returned 0x20 [0033.204] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0x5c8f80 [0033.204] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a683760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0 [0033.204] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.204] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk")) returned 1 [0033.205] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk")) returned 0xffffffff [0033.206] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 1 [0033.206] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk")) returned 0x20 [0033.206] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.206] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.207] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x5a7, lpOverlapped=0x0) returned 1 [0033.208] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x5a7, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x5a7, lpOverlapped=0x0) returned 1 [0033.209] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.209] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.209] CloseHandle (hObject=0x114) returned 1 [0033.209] CloseHandle (hObject=0xfc) returned 1 [0033.210] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.crypt")) returned 0 [0033.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.crypt")) returned 0x20 [0033.210] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 0x5c8f80 [0033.210] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb0f970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4eb0f970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4eb0f970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 0 [0033.210] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.211] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk")) returned 1 [0033.212] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk")) returned 0xffffffff [0033.212] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1 [0033.212] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 0x20 [0033.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.213] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x122, lpOverlapped=0x0) returned 1 [0033.214] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x122, lpOverlapped=0x0) returned 1 [0033.214] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.215] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.215] CloseHandle (hObject=0xfc) returned 1 [0033.215] CloseHandle (hObject=0x114) returned 1 [0033.215] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.crypt")) returned 0 [0033.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.crypt")) returned 0x20 [0033.216] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 0x5c8f80 [0033.216] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 0 [0033.216] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.216] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 1 [0033.217] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 0xffffffff [0033.217] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1 [0033.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.217] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.217] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd0, dwReserved1=0x0, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0033.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0033.218] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName="..", cAlternateFileName="")) returned 1 [0033.218] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName="..", cAlternateFileName="")) returned 0 [0033.218] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.218] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0033.218] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0033.218] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName="..", cAlternateFileName="")) returned 1 [0033.218] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.218] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 0x6 [0033.218] VirtualAlloc (lpAddress=0x1ffc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ffc000 [0033.218] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0033.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.219] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x19c, lpOverlapped=0x0) returned 1 [0033.220] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x19c, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x19c, lpOverlapped=0x0) returned 1 [0033.228] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.238] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.238] CloseHandle (hObject=0x108) returned 1 [0033.238] CloseHandle (hObject=0x104) returned 1 [0033.239] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.crypt")) returned 0 [0033.240] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.crypt")) returned 0x20 [0033.240] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0033.240] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.240] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0033.240] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 1 [0033.241] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 0xffffffff [0033.241] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x5d0e78, dwReserved1=0x18e79c, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0033.241] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk")) returned 0x20 [0033.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0033.243] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x8dd, lpOverlapped=0x0) returned 1 [0033.244] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x8dd, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x8dd, lpOverlapped=0x0) returned 1 [0033.244] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.244] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.244] CloseHandle (hObject=0x104) returned 1 [0033.245] CloseHandle (hObject=0x108) returned 1 [0033.245] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk.crypt")) returned 0 [0033.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk.crypt")) returned 0x20 [0033.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0x5c9000 [0033.246] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0 [0033.246] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0033.246] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk")) returned 1 [0033.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk")) returned 0xffffffff [0033.247] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x5d0e78, dwReserved1=0x18e79c, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0033.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk")) returned 0x20 [0033.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0033.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.249] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x5ad, lpOverlapped=0x0) returned 1 [0033.250] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x5ad, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x5ad, lpOverlapped=0x0) returned 1 [0033.250] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.250] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.250] CloseHandle (hObject=0x108) returned 1 [0033.251] CloseHandle (hObject=0x104) returned 1 [0033.252] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.crypt")) returned 0 [0033.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.crypt")) returned 0x20 [0033.252] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0x5c9000 [0033.253] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0 [0033.253] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0033.253] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk")) returned 1 [0033.254] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk")) returned 0xffffffff [0033.254] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0033.254] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 0x20 [0033.256] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.256] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0033.257] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x5a9, lpOverlapped=0x0) returned 1 [0033.259] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x5a9, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x5a9, lpOverlapped=0x0) returned 1 [0033.260] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.260] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.260] CloseHandle (hObject=0x104) returned 1 [0033.260] CloseHandle (hObject=0x108) returned 1 [0033.261] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.crypt")) returned 0 [0033.261] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.crypt")) returned 0x20 [0033.261] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x5c9000 [0033.261] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0033.261] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0033.261] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 1 [0033.262] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 0xffffffff [0033.262] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x5d0e78, dwReserved1=0x18e79c, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0033.262] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk")) returned 0x20 [0033.262] VirtualAlloc (lpAddress=0x2000000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2000000 [0033.263] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0033.263] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.264] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x491, lpOverlapped=0x0) returned 1 [0033.264] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x491, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x491, lpOverlapped=0x0) returned 1 [0033.265] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.265] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.265] CloseHandle (hObject=0x108) returned 1 [0033.265] CloseHandle (hObject=0x104) returned 1 [0033.266] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.crypt")) returned 0 [0033.266] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.crypt")) returned 0x20 [0033.266] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0x5c9000 [0033.266] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0033.266] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0033.267] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk")) returned 1 [0033.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk")) returned 0xffffffff [0033.268] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x5d0e78, dwReserved1=0x18e79c, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0033.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk")) returned 0x20 [0033.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.268] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0033.269] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x4cc, lpOverlapped=0x0) returned 1 [0033.270] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x4cc, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x4cc, lpOverlapped=0x0) returned 1 [0033.270] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.270] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.270] CloseHandle (hObject=0x104) returned 1 [0033.271] CloseHandle (hObject=0x108) returned 1 [0033.271] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.crypt")) returned 0 [0033.271] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.crypt")) returned 0x20 [0033.271] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0x5c9000 [0033.272] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0 [0033.272] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0033.272] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk")) returned 1 [0033.273] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk")) returned 0xffffffff [0033.273] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x5d0e78, dwReserved1=0x18e79c, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0033.273] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 0x20 [0033.273] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0033.273] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.274] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x4cc, lpOverlapped=0x0) returned 1 [0033.276] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x4cc, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x4cc, lpOverlapped=0x0) returned 1 [0033.277] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.277] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.277] CloseHandle (hObject=0x108) returned 1 [0033.277] CloseHandle (hObject=0x104) returned 1 [0033.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.crypt")) returned 0 [0033.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.crypt")) returned 0x20 [0033.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x5c9000 [0033.278] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0033.278] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0033.278] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 1 [0033.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 0xffffffff [0033.279] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x5d0e78, dwReserved1=0x18e79c, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0033.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk")) returned 0x20 [0033.279] VirtualAlloc (lpAddress=0x2004000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2004000 [0033.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0033.281] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x60b, lpOverlapped=0x0) returned 1 [0033.281] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x60b, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x60b, lpOverlapped=0x0) returned 1 [0033.282] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.282] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.282] CloseHandle (hObject=0x104) returned 1 [0033.282] CloseHandle (hObject=0x108) returned 1 [0033.284] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.crypt")) returned 0 [0033.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.crypt")) returned 0x20 [0033.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0x5c9000 [0033.285] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0 [0033.285] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0033.285] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk")) returned 1 [0033.286] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk")) returned 0xffffffff [0033.286] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0033.286] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 0x20 [0033.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0033.287] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.288] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x60b, lpOverlapped=0x0) returned 1 [0033.289] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x60b, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x60b, lpOverlapped=0x0) returned 1 [0033.290] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.290] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0033.290] CloseHandle (hObject=0x108) returned 1 [0033.290] CloseHandle (hObject=0x104) returned 1 [0033.291] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.crypt")) returned 0 [0033.291] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.crypt")) returned 0x20 [0033.291] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x5c9000 [0033.292] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0033.292] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0033.292] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 1 [0033.293] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 0xffffffff [0033.293] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0033.293] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.293] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd0, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0033.293] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.293] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0033.293] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 0x20 [0033.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.294] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x110, lpOverlapped=0x0) returned 1 [0033.295] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x110, lpOverlapped=0x0) returned 1 [0033.296] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.296] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.296] CloseHandle (hObject=0x114) returned 1 [0033.296] CloseHandle (hObject=0xfc) returned 1 [0033.297] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.crypt")) returned 0 [0033.297] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.crypt")) returned 0x20 [0033.297] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x5c8f80 [0033.297] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0033.297] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.297] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 1 [0033.298] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 0xffffffff [0033.298] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0033.298] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.298] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="UserData", cAlternateFileName="")) returned 1 [0033.298] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.300] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0033.300] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Low", cAlternateFileName="")) returned 1 [0033.300] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.300] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.300] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd4, dwReserved1=0x0, cFileName="65UX3YG0", cAlternateFileName="")) returned 1 [0033.300] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0033.301] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.301] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.301] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.301] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd4, dwReserved1=0x0, cFileName="AY721QDR", cAlternateFileName="")) returned 1 [0033.301] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0033.301] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.301] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.302] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.302] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd4, dwReserved1=0x0, cFileName="DZBKZBIC", cAlternateFileName="")) returned 1 [0033.302] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0033.302] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.302] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.302] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.302] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xd4, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0033.302] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd4, dwReserved1=0x0, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 1 [0033.302] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0033.302] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.302] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.302] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.303] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd4, dwReserved1=0x0, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 0 [0033.303] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.303] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Low", cAlternateFileName="")) returned 0 [0033.303] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.303] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="UserData", cAlternateFileName="")) returned 0 [0033.303] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.303] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1 [0033.303] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.303] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0033.303] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 0 [0033.304] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.304] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1 [0033.304] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.305] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0033.305] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="14", cAlternateFileName="")) returned 1 [0033.305] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.305] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0033.305] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="1033", cAlternateFileName="")) returned 1 [0033.305] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.306] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.306] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.MPT", cAlternateFileName="")) returned 1 [0033.306] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Global.MPT", cAlternateFileName="")) returned 0 [0033.306] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.306] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="1033", cAlternateFileName="")) returned 0 [0033.306] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.307] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="14", cAlternateFileName="")) returned 0 [0033.307] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.307] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0033.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.307] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0033.307] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0033.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.307] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0033.307] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Pbk", cAlternateFileName="")) returned 1 [0033.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.308] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.308] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 1 [0033.308] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0033.308] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.308] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 1 [0033.308] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0 [0033.308] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.308] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 0 [0033.308] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.308] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Pbk", cAlternateFileName="")) returned 0 [0033.308] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.308] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0033.308] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.309] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0033.309] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.310] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0033.310] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ce7b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f6ce7b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f6ce7b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="MSO1033.acl", cAlternateFileName="")) returned 1 [0033.310] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="Recent", cAlternateFileName="")) returned 1 [0033.310] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.311] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0033.311] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90b3d80, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Global.LNK", cAlternateFileName="")) returned 1 [0033.311] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x34, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0033.311] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 1 [0033.311] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 0 [0033.311] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.311] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="Recent", cAlternateFileName="")) returned 0 [0033.311] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.312] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0033.313] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.314] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0033.314] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de69980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5de69980, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5e0c9040, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName="Outlook.srs", cAlternateFileName="")) returned 1 [0033.314] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName="Outlook.xml", cAlternateFileName="")) returned 1 [0033.314] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName="Outlook.xml", cAlternateFileName="")) returned 0 [0033.314] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.314] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1 [0033.314] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.315] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0033.315] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 0 [0033.315] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.315] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="Proof", cAlternateFileName="")) returned 1 [0033.315] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.316] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0033.316] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 0 [0033.316] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.317] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d6f68, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0033.317] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.317] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0033.317] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0033.317] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72654b4e, dwReserved1=0x6b6e6c2e, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1 [0033.317] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.319] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0033.319] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1 [0033.319] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0033.319] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0033.319] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.320] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3939, dwReserved1=0x2d356635, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~2")) returned 1 [0033.320] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.322] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0033.322] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf923e050, ftCreationTime.dwHighDateTime=0x1d3aab9, ftLastAccessTime.dwLowDateTime=0xf923e050, ftLastAccessTime.dwHighDateTime=0x1d3aab9, ftLastWriteTime.dwLowDateTime=0xf923e050, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="02540a10-7eb7-4b20-a8c7-470f8986389c", cAlternateFileName="02540A~1")) returned 1 [0033.322] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xdc5ea830, ftCreationTime.dwHighDateTime=0x1d41fce, ftLastAccessTime.dwLowDateTime=0xdc5ea830, ftLastAccessTime.dwHighDateTime=0x1d41fce, ftLastWriteTime.dwLowDateTime=0xdc5ea830, ftLastWriteTime.dwHighDateTime=0x1d41fce, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="0e15476d-d8fe-46ca-8099-ebdcf80f637c", cAlternateFileName="0E1547~1")) returned 1 [0033.322] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6409280, ftCreationTime.dwHighDateTime=0x1d4ae2c, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="102a7bc8-3f85-4bb4-840a-38257d2965d2", cAlternateFileName="102A7B~1")) returned 1 [0033.322] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542b0350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542b0350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x542b0350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="2be989a0-16a1-424b-9211-51aa3bb43e5d", cAlternateFileName="2BE989~1")) returned 1 [0033.322] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x17ffec90, ftCreationTime.dwHighDateTime=0x1d3373c, ftLastAccessTime.dwLowDateTime=0x17ffec90, ftLastAccessTime.dwHighDateTime=0x1d3373c, ftLastWriteTime.dwLowDateTime=0x18024df0, ftLastWriteTime.dwHighDateTime=0x1d3373c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="fbbe72db-afd8-443b-88dd-64b20388700d", cAlternateFileName="FBBE72~1")) returned 1 [0033.322] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xf6455540, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0033.322] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xf6455540, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0033.322] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.323] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0033.323] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="SYNCHIST", cAlternateFileName="")) returned 0 [0033.323] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.323] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0033.323] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.324] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="..", cAlternateFileName="")) returned 1 [0033.324] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="..", cAlternateFileName="")) returned 0 [0033.324] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.324] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1 [0033.324] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.326] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="..", cAlternateFileName="")) returned 1 [0033.326] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 1 [0033.326] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 0 [0033.326] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.326] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="Speech", cAlternateFileName="")) returned 1 [0033.326] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.329] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="..", cAlternateFileName="")) returned 1 [0033.329] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="..", cAlternateFileName="")) returned 0 [0033.329] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.329] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0033.329] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.329] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="..", cAlternateFileName="")) returned 1 [0033.329] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="My", cAlternateFileName="")) returned 1 [0033.329] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.330] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0033.330] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0033.330] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.330] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.330] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.330] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.330] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="CRLs", cAlternateFileName="")) returned 1 [0033.330] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.330] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.330] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.331] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.331] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="CTLs", cAlternateFileName="")) returned 1 [0033.331] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.331] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.331] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.331] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.331] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="CTLs", cAlternateFileName="")) returned 0 [0033.331] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.331] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3864, dwReserved1=0x2d623334, cFileName="My", cAlternateFileName="")) returned 0 [0033.331] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.331] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0033.331] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3873, dwReserved1=0x2d623334, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.332] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3873, dwReserved1=0x2d623334, cFileName="..", cAlternateFileName="")) returned 1 [0033.332] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x342d3873, dwReserved1=0x2d623334, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1 [0033.332] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x342d3873, dwReserved1=0x2d623334, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 0 [0033.332] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.333] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="UProof", cAlternateFileName="")) returned 1 [0033.333] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3873, dwReserved1=0x2d623334, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.333] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3873, dwReserved1=0x2d623334, cFileName="..", cAlternateFileName="")) returned 1 [0033.334] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x342d3873, dwReserved1=0x2d623334, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 1 [0033.334] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x342d3873, dwReserved1=0x2d623334, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 0 [0033.334] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0033.334] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d782e65, dwReserved1=0x3337396c, cFileName="Windows", cAlternateFileName="")) returned 1 [0033.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3873, dwReserved1=0x2d623334, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0033.334] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3873, dwReserved1=0x2d623334, cFileName="..", cAlternateFileName="")) returned 1 [0033.334] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3873, dwReserved1=0x2d623334, cFileName="Cookies", cAlternateFileName="")) returned 1 [0033.334] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.334] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0033.334] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0033.334] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt")) returned 0x2020 [0033.335] VirtualAlloc (lpAddress=0x2008000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2008000 [0033.335] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.335] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.336] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x53, lpOverlapped=0x0) returned 1 [0033.337] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x53, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x53, lpOverlapped=0x0) returned 1 [0033.337] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.337] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.338] CloseHandle (hObject=0xfc) returned 1 [0033.338] CloseHandle (hObject=0x114) returned 1 [0033.338] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.crypt")) returned 0 [0033.339] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.crypt")) returned 0x2020 [0033.339] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0x5c8f80 [0033.339] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0 [0033.339] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.339] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt")) returned 1 [0033.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt")) returned 0xffffffff [0033.340] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 1 [0033.340] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt")) returned 0x2020 [0033.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.342] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x227, lpOverlapped=0x0) returned 1 [0033.343] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x227, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x227, lpOverlapped=0x0) returned 1 [0033.343] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.344] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.344] CloseHandle (hObject=0x114) returned 1 [0033.344] CloseHandle (hObject=0xfc) returned 1 [0033.344] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.crypt")) returned 0 [0033.345] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.crypt")) returned 0x2020 [0033.345] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 0x5c8f80 [0033.345] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e6a4bd0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt", cAlternateFileName="5P0100~1.TXT")) returned 0 [0033.345] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.345] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt")) returned 1 [0033.346] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt")) returned 0xffffffff [0033.346] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 1 [0033.346] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt")) returned 0x2020 [0033.347] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.347] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.348] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xf1, lpOverlapped=0x0) returned 1 [0033.349] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xf1, lpOverlapped=0x0) returned 1 [0033.349] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.350] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.350] CloseHandle (hObject=0xfc) returned 1 [0033.350] CloseHandle (hObject=0x114) returned 1 [0033.350] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.crypt")) returned 0 [0033.351] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.crypt")) returned 0x2020 [0033.351] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 0x5c8f80 [0033.351] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt", cAlternateFileName="5PFFE8~1.TXT")) returned 0 [0033.351] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.351] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt")) returned 1 [0033.352] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt")) returned 0xffffffff [0033.352] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 1 [0033.352] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt")) returned 0x2020 [0033.352] VirtualAlloc (lpAddress=0x200c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x200c000 [0033.353] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.353] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.353] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x6f, lpOverlapped=0x0) returned 1 [0033.354] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x6f, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x6f, lpOverlapped=0x0) returned 1 [0033.355] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.355] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.355] CloseHandle (hObject=0x114) returned 1 [0033.355] CloseHandle (hObject=0xfc) returned 1 [0033.356] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.crypt")) returned 0 [0033.356] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.crypt")) returned 0x2020 [0033.356] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 0x5c8f80 [0033.356] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e658910, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", cAlternateFileName="5PB43E~1.TXT")) returned 0 [0033.356] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.356] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt")) returned 1 [0033.357] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt")) returned 0xffffffff [0033.357] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1 [0033.357] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt")) returned 0x2020 [0033.358] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.358] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.358] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x6e, lpOverlapped=0x0) returned 1 [0033.359] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x6e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x6e, lpOverlapped=0x0) returned 1 [0033.360] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.360] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.360] CloseHandle (hObject=0xfc) returned 1 [0033.360] CloseHandle (hObject=0x114) returned 1 [0033.361] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.crypt")) returned 0 [0033.361] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.crypt")) returned 0x2020 [0033.362] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 0x5c8f80 [0033.362] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 0 [0033.362] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.362] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt")) returned 1 [0033.363] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt")) returned 0xffffffff [0033.363] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1 [0033.363] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt")) returned 0x2020 [0033.364] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.364] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.365] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x114, lpOverlapped=0x0) returned 1 [0033.365] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x114, lpOverlapped=0x0) returned 1 [0033.366] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.366] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.366] CloseHandle (hObject=0x114) returned 1 [0033.366] CloseHandle (hObject=0xfc) returned 1 [0033.367] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.crypt")) returned 0 [0033.367] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.crypt")) returned 0x2020 [0033.367] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 0x5c8f80 [0033.368] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 0 [0033.368] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.368] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt")) returned 1 [0033.369] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt")) returned 0xffffffff [0033.369] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 1 [0033.369] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt")) returned 0x2020 [0033.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.370] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x56, lpOverlapped=0x0) returned 1 [0033.371] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x56, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x56, lpOverlapped=0x0) returned 1 [0033.372] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.372] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.372] CloseHandle (hObject=0xfc) returned 1 [0033.372] CloseHandle (hObject=0x114) returned 1 [0033.372] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.crypt")) returned 0 [0033.373] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.crypt")) returned 0x2020 [0033.373] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 0x5c8f80 [0033.373] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1dcf9270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt", cAlternateFileName="5P0DBF~1.TXT")) returned 0 [0033.373] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.373] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt")) returned 1 [0033.374] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt")) returned 0xffffffff [0033.374] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 1 [0033.374] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt")) returned 0x2020 [0033.375] VirtualAlloc (lpAddress=0x2010000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2010000 [0033.375] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.375] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.376] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x19e, lpOverlapped=0x0) returned 1 [0033.377] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x19e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x19e, lpOverlapped=0x0) returned 1 [0033.378] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.378] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.378] CloseHandle (hObject=0x114) returned 1 [0033.378] CloseHandle (hObject=0xfc) returned 1 [0033.379] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.crypt")) returned 0 [0033.379] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.crypt")) returned 0x2020 [0033.379] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 0x5c8f80 [0033.379] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1e5e64f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt", cAlternateFileName="5P94E6~1.TXT")) returned 0 [0033.379] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.379] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt")) returned 1 [0033.380] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt")) returned 0xffffffff [0033.380] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x9b4223a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0033.380] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Low", cAlternateFileName="")) returned 1 [0033.380] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.383] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.384] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0xd2, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 1 [0033.384] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt")) returned 0x2020 [0033.385] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.385] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.385] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x66, lpOverlapped=0x0) returned 1 [0033.386] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x66, lpOverlapped=0x0) returned 1 [0033.387] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.387] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.387] CloseHandle (hObject=0x114) returned 1 [0033.387] CloseHandle (hObject=0x104) returned 1 [0033.388] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.crypt")) returned 0 [0033.388] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.crypt")) returned 0x2020 [0033.388] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 0x5c8fc0 [0033.388] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44eb6480, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", cAlternateFileName="5P9943~1.TXT")) returned 0 [0033.388] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.388] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt")) returned 1 [0033.389] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt")) returned 0xffffffff [0033.389] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 1 [0033.389] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt")) returned 0x2020 [0033.390] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.390] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.390] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x66, lpOverlapped=0x0) returned 1 [0033.391] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x66, lpOverlapped=0x0) returned 1 [0033.393] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.393] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.393] CloseHandle (hObject=0x104) returned 1 [0033.393] CloseHandle (hObject=0x114) returned 1 [0033.394] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.crypt")) returned 0 [0033.395] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.crypt")) returned 0x2020 [0033.395] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 0x5c8fc0 [0033.395] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", cAlternateFileName="5P37D9~1.TXT")) returned 0 [0033.395] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.395] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt")) returned 1 [0033.396] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt")) returned 0xffffffff [0033.396] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 1 [0033.396] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt")) returned 0x2020 [0033.397] VirtualAlloc (lpAddress=0x2014000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2014000 [0033.397] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.397] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.397] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x5d, lpOverlapped=0x0) returned 1 [0033.398] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x5d, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x5d, lpOverlapped=0x0) returned 1 [0033.399] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.399] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.399] CloseHandle (hObject=0x114) returned 1 [0033.399] CloseHandle (hObject=0x104) returned 1 [0033.400] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.crypt")) returned 0 [0033.400] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.crypt")) returned 0x2020 [0033.400] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 0x5c8fc0 [0033.400] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt", cAlternateFileName="5P2CBA~1.TXT")) returned 0 [0033.400] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.401] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt")) returned 1 [0033.401] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt")) returned 0xffffffff [0033.401] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 1 [0033.401] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt")) returned 0x2020 [0033.402] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.403] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.403] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xea, lpOverlapped=0x0) returned 1 [0033.404] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xea, lpOverlapped=0x0) returned 1 [0033.405] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.405] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.405] CloseHandle (hObject=0x104) returned 1 [0033.405] CloseHandle (hObject=0x114) returned 1 [0033.405] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.crypt")) returned 0 [0033.406] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.crypt")) returned 0x2020 [0033.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 0x5c8fc0 [0033.406] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt", cAlternateFileName="5P8600~1.TXT")) returned 0 [0033.406] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.406] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt")) returned 1 [0033.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt")) returned 0xffffffff [0033.407] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 1 [0033.407] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt")) returned 0x2020 [0033.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.408] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x242, lpOverlapped=0x0) returned 1 [0033.410] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x242, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x242, lpOverlapped=0x0) returned 1 [0033.410] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.411] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.411] CloseHandle (hObject=0x114) returned 1 [0033.411] CloseHandle (hObject=0x104) returned 1 [0033.411] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.crypt")) returned 0 [0033.412] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.crypt")) returned 0x2020 [0033.412] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 0x5c8fc0 [0033.412] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45f08810, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt", cAlternateFileName="5P89EF~1.TXT")) returned 0 [0033.412] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.412] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt")) returned 1 [0033.413] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt")) returned 0xffffffff [0033.413] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 1 [0033.413] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt")) returned 0x2020 [0033.413] VirtualAlloc (lpAddress=0x2018000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2018000 [0033.413] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.414] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x65, lpOverlapped=0x0) returned 1 [0033.415] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x65, lpOverlapped=0x0) returned 1 [0033.416] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.416] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.416] CloseHandle (hObject=0x104) returned 1 [0033.416] CloseHandle (hObject=0x114) returned 1 [0033.416] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.crypt")) returned 0 [0033.417] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.crypt")) returned 0x2020 [0033.417] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 0x5c8fc0 [0033.417] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt", cAlternateFileName="5PC5B2~1.TXT")) returned 0 [0033.417] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.417] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt")) returned 1 [0033.418] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt")) returned 0xffffffff [0033.418] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 1 [0033.418] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt")) returned 0x2020 [0033.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.418] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.419] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x52, lpOverlapped=0x0) returned 1 [0033.420] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x52, lpOverlapped=0x0) returned 1 [0033.420] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.420] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.421] CloseHandle (hObject=0x114) returned 1 [0033.421] CloseHandle (hObject=0x104) returned 1 [0033.421] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.crypt")) returned 0 [0033.421] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.crypt")) returned 0x2020 [0033.422] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 0x5c8fc0 [0033.422] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c70990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt", cAlternateFileName="5P5NRG~3.TXT")) returned 0 [0033.422] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.422] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt")) returned 1 [0033.423] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt")) returned 0xffffffff [0033.423] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0033.423] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt")) returned 0x2020 [0033.423] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.423] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.423] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x125, lpOverlapped=0x0) returned 1 [0033.425] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x125, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x125, lpOverlapped=0x0) returned 1 [0033.425] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.425] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.425] CloseHandle (hObject=0x104) returned 1 [0033.426] CloseHandle (hObject=0x114) returned 1 [0033.426] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.crypt")) returned 0 [0033.426] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.crypt")) returned 0x2020 [0033.426] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0x5c8fc0 [0033.427] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x51332930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 0 [0033.427] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.427] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt")) returned 1 [0033.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt")) returned 0xffffffff [0033.428] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 1 [0033.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt")) returned 0x2020 [0033.428] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.429] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.429] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xdd, lpOverlapped=0x0) returned 1 [0033.430] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xdd, lpOverlapped=0x0) returned 1 [0033.431] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.431] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.431] CloseHandle (hObject=0x114) returned 1 [0033.431] CloseHandle (hObject=0x104) returned 1 [0033.431] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.crypt")) returned 0 [0033.432] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.crypt")) returned 0x2020 [0033.432] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 0x5c8fc0 [0033.432] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54cce0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt", cAlternateFileName="5P40FC~1.TXT")) returned 0 [0033.432] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.432] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt")) returned 1 [0033.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt")) returned 0xffffffff [0033.433] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 1 [0033.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt")) returned 0x2020 [0033.433] VirtualAlloc (lpAddress=0x201c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x201c000 [0033.433] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.434] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.434] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x201, lpOverlapped=0x0) returned 1 [0033.435] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x201, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x201, lpOverlapped=0x0) returned 1 [0033.436] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.436] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.436] CloseHandle (hObject=0x104) returned 1 [0033.436] CloseHandle (hObject=0x114) returned 1 [0033.436] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.crypt")) returned 0 [0033.437] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.crypt")) returned 0x2020 [0033.437] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 0x5c8fc0 [0033.437] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x4611db50, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt", cAlternateFileName="5P74F0~1.TXT")) returned 0 [0033.437] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.437] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt")) returned 1 [0033.440] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt")) returned 0xffffffff [0033.440] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 1 [0033.440] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt")) returned 0x2020 [0033.441] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.441] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.441] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x1ea, lpOverlapped=0x0) returned 1 [0033.442] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x1ea, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x1ea, lpOverlapped=0x0) returned 1 [0033.443] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.443] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.443] CloseHandle (hObject=0x114) returned 1 [0033.443] CloseHandle (hObject=0x104) returned 1 [0033.444] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.crypt")) returned 0 [0033.444] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.crypt")) returned 0x2020 [0033.444] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 0x5c8fc0 [0033.444] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x562c6900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt", cAlternateFileName="5PBE12~1.TXT")) returned 0 [0033.444] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.444] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt")) returned 1 [0033.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt")) returned 0xffffffff [0033.445] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 1 [0033.445] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt")) returned 0x2020 [0033.445] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.446] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.446] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x1c8, lpOverlapped=0x0) returned 1 [0033.447] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x1c8, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x1c8, lpOverlapped=0x0) returned 1 [0033.448] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.448] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.448] CloseHandle (hObject=0x104) returned 1 [0033.448] CloseHandle (hObject=0x114) returned 1 [0033.448] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.crypt")) returned 0 [0033.449] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.crypt")) returned 0x2020 [0033.449] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 0x5c8fc0 [0033.449] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45798350, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt", cAlternateFileName="5P5NRG~2.TXT")) returned 0 [0033.449] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.449] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt")) returned 1 [0033.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt")) returned 0xffffffff [0033.450] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 1 [0033.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt")) returned 0x2020 [0033.451] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x30f0000 [0033.451] VirtualAlloc (lpAddress=0x30f0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x30f0000 [0033.451] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.451] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.452] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x82, lpOverlapped=0x0) returned 1 [0033.452] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x82, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x82, lpOverlapped=0x0) returned 1 [0033.453] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.453] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.453] CloseHandle (hObject=0x114) returned 1 [0033.453] CloseHandle (hObject=0x104) returned 1 [0033.455] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.crypt")) returned 0 [0033.455] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.crypt")) returned 0x2020 [0033.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 0x5c8fc0 [0033.455] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdf95770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt", cAlternateFileName="5PB89C~1.TXT")) returned 0 [0033.455] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.455] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt")) returned 1 [0033.456] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt")) returned 0xffffffff [0033.456] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 1 [0033.456] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt")) returned 0x2020 [0033.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.460] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x110, lpOverlapped=0x0) returned 1 [0033.461] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x110, lpOverlapped=0x0) returned 1 [0033.462] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.462] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.462] CloseHandle (hObject=0x104) returned 1 [0033.462] CloseHandle (hObject=0x114) returned 1 [0033.462] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.crypt")) returned 0 [0033.463] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.crypt")) returned 0x2020 [0033.463] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 0x5c8fc0 [0033.463] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63a15b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt", cAlternateFileName="5P93CC~1.TXT")) returned 0 [0033.463] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.463] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt")) returned 1 [0033.464] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt")) returned 0xffffffff [0033.464] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 1 [0033.464] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt")) returned 0x2020 [0033.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.464] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.465] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x256, lpOverlapped=0x0) returned 1 [0033.466] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x256, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x256, lpOverlapped=0x0) returned 1 [0033.467] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.467] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.467] CloseHandle (hObject=0x114) returned 1 [0033.467] CloseHandle (hObject=0x104) returned 1 [0033.468] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.crypt")) returned 0 [0033.468] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.crypt")) returned 0x2020 [0033.468] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 0x5c8fc0 [0033.468] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt", cAlternateFileName="5P12F9~1.TXT")) returned 0 [0033.468] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.468] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt")) returned 1 [0033.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt")) returned 0xffffffff [0033.469] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 1 [0033.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt")) returned 0x2020 [0033.469] VirtualAlloc (lpAddress=0x30f4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x30f4000 [0033.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.470] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xc4, lpOverlapped=0x0) returned 1 [0033.471] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xc4, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xc4, lpOverlapped=0x0) returned 1 [0033.472] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.472] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.472] CloseHandle (hObject=0x104) returned 1 [0033.472] CloseHandle (hObject=0x114) returned 1 [0033.473] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.crypt")) returned 0 [0033.473] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.crypt")) returned 0x2020 [0033.473] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 0x5c8fc0 [0033.473] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt", cAlternateFileName="5P692F~1.TXT")) returned 0 [0033.473] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.474] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt")) returned 1 [0033.474] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt")) returned 0xffffffff [0033.474] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 1 [0033.474] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt")) returned 0x2020 [0033.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.475] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x21f, lpOverlapped=0x0) returned 1 [0033.476] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x21f, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x21f, lpOverlapped=0x0) returned 1 [0033.477] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.477] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.477] CloseHandle (hObject=0x114) returned 1 [0033.477] CloseHandle (hObject=0x104) returned 1 [0033.478] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.crypt")) returned 0 [0033.478] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.crypt")) returned 0x2020 [0033.478] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 0x5c8fc0 [0033.478] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e777a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt", cAlternateFileName="5P3B8C~1.TXT")) returned 0 [0033.478] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.478] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt")) returned 1 [0033.479] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt")) returned 0xffffffff [0033.479] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 1 [0033.479] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt")) returned 0x2020 [0033.479] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.480] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.480] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x110, lpOverlapped=0x0) returned 1 [0033.481] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x110, lpOverlapped=0x0) returned 1 [0033.482] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.482] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.482] CloseHandle (hObject=0x104) returned 1 [0033.482] CloseHandle (hObject=0x114) returned 1 [0033.482] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.crypt")) returned 0 [0033.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.crypt")) returned 0x2020 [0033.483] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 0x5c8fc0 [0033.483] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x465ba5f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt", cAlternateFileName="5P1C80~1.TXT")) returned 0 [0033.483] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.483] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt")) returned 1 [0033.484] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt")) returned 0xffffffff [0033.484] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 1 [0033.484] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt")) returned 0x2020 [0033.484] VirtualAlloc (lpAddress=0x30f8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x30f8000 [0033.484] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.484] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.485] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x76, lpOverlapped=0x0) returned 1 [0033.486] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x76, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x76, lpOverlapped=0x0) returned 1 [0033.487] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.487] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.487] CloseHandle (hObject=0x114) returned 1 [0033.487] CloseHandle (hObject=0x104) returned 1 [0033.488] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.crypt")) returned 0 [0033.488] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.crypt")) returned 0x2020 [0033.488] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 0x5c8fc0 [0033.488] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa5cef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt", cAlternateFileName="5PD7A3~1.TXT")) returned 0 [0033.488] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.488] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt")) returned 1 [0033.489] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt")) returned 0xffffffff [0033.489] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 1 [0033.489] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt")) returned 0x2020 [0033.490] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.490] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.490] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x337, lpOverlapped=0x0) returned 1 [0033.492] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x337, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x337, lpOverlapped=0x0) returned 1 [0033.493] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.493] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.493] CloseHandle (hObject=0x104) returned 1 [0033.493] CloseHandle (hObject=0x114) returned 1 [0033.493] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.crypt")) returned 0 [0033.494] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.crypt")) returned 0x2020 [0033.494] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 0x5c8fc0 [0033.494] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50b50050, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt", cAlternateFileName="5PBFF9~1.TXT")) returned 0 [0033.494] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.494] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt")) returned 1 [0033.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt")) returned 0xffffffff [0033.495] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 1 [0033.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt")) returned 0x2020 [0033.495] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.495] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.496] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xce, lpOverlapped=0x0) returned 1 [0033.496] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xce, lpOverlapped=0x0) returned 1 [0033.497] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.497] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.497] CloseHandle (hObject=0x114) returned 1 [0033.497] CloseHandle (hObject=0x104) returned 1 [0033.498] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.crypt")) returned 0 [0033.498] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.crypt")) returned 0x2020 [0033.498] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 0x5c8fc0 [0033.498] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5348e0b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", cAlternateFileName="5P5NRG~4.TXT")) returned 0 [0033.499] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.499] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt")) returned 1 [0033.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt")) returned 0xffffffff [0033.500] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 1 [0033.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt")) returned 0x2020 [0033.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.500] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.500] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x6c, lpOverlapped=0x0) returned 1 [0033.501] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x6c, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x6c, lpOverlapped=0x0) returned 1 [0033.503] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.503] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.503] CloseHandle (hObject=0x104) returned 1 [0033.503] CloseHandle (hObject=0x114) returned 1 [0033.503] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.crypt")) returned 0 [0033.504] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.crypt")) returned 0x2020 [0033.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 0x5c8fc0 [0033.504] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf73d210, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", cAlternateFileName="5P4910~1.TXT")) returned 0 [0033.504] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.504] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt")) returned 1 [0033.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt")) returned 0xffffffff [0033.505] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 1 [0033.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt")) returned 0x2020 [0033.505] VirtualAlloc (lpAddress=0x30fc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x30fc000 [0033.505] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.506] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x68, lpOverlapped=0x0) returned 1 [0033.507] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x68, lpOverlapped=0x0) returned 1 [0033.508] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.508] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.508] CloseHandle (hObject=0x114) returned 1 [0033.508] CloseHandle (hObject=0x104) returned 1 [0033.508] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.crypt")) returned 0 [0033.509] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.crypt")) returned 0x2020 [0033.509] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 0x5c8fc0 [0033.509] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf99e810, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt", cAlternateFileName="5P37A2~1.TXT")) returned 0 [0033.509] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.509] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt")) returned 1 [0033.510] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt")) returned 0xffffffff [0033.510] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 1 [0033.510] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt")) returned 0x2020 [0033.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.511] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.511] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xb2, lpOverlapped=0x0) returned 1 [0033.512] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xb2, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xb2, lpOverlapped=0x0) returned 1 [0033.513] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.513] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.513] CloseHandle (hObject=0x104) returned 1 [0033.513] CloseHandle (hObject=0x114) returned 1 [0033.514] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.crypt")) returned 0 [0033.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.crypt")) returned 0x2020 [0033.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 0x5c8fc0 [0033.514] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt", cAlternateFileName="5PD4D3~1.TXT")) returned 0 [0033.514] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.514] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt")) returned 1 [0033.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt")) returned 0xffffffff [0033.515] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 1 [0033.515] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt")) returned 0x2020 [0033.515] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.516] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.516] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xd7, lpOverlapped=0x0) returned 1 [0033.517] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xd7, lpOverlapped=0x0) returned 1 [0033.518] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.518] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.518] CloseHandle (hObject=0x114) returned 1 [0033.518] CloseHandle (hObject=0x104) returned 1 [0033.518] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.crypt")) returned 0 [0033.519] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.crypt")) returned 0x2020 [0033.519] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 0x5c8fc0 [0033.519] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x555a9a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt", cAlternateFileName="5PA943~1.TXT")) returned 0 [0033.519] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.519] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt")) returned 1 [0033.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt")) returned 0xffffffff [0033.520] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 1 [0033.520] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt")) returned 0x2020 [0033.520] VirtualAlloc (lpAddress=0x3100000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3100000 [0033.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.521] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xa9, lpOverlapped=0x0) returned 1 [0033.524] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xa9, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xa9, lpOverlapped=0x0) returned 1 [0033.525] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.525] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.525] CloseHandle (hObject=0x104) returned 1 [0033.525] CloseHandle (hObject=0x114) returned 1 [0033.526] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.crypt")) returned 0 [0033.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.crypt")) returned 0x2020 [0033.527] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 0x5c8fc0 [0033.527] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d8c7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", cAlternateFileName="5PC3D9~1.TXT")) returned 0 [0033.527] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.527] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt")) returned 1 [0033.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt")) returned 0xffffffff [0033.528] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 1 [0033.528] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt")) returned 0x2020 [0033.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0033.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.529] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x402, lpOverlapped=0x0) returned 1 [0033.530] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x402, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x402, lpOverlapped=0x0) returned 1 [0033.531] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.531] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0033.531] CloseHandle (hObject=0x114) returned 1 [0033.531] CloseHandle (hObject=0x104) returned 1 [0033.532] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.crypt")) returned 0 [0033.532] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.crypt")) returned 0x2020 [0033.532] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 0x5c8fc0 [0033.532] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x526fc010, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt", cAlternateFileName="5PD551~1.TXT")) returned 0 [0033.533] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0033.533] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt")) returned 1 [0033.534] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt")) returned 0xffffffff [0033.534] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="index.dat", cAlternateFileName="")) returned 1 [0033.534] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="index.dat", cAlternateFileName="")) returned 0 [0033.534] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.534] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52878dd0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="Low", cAlternateFileName="")) returned 0 [0033.534] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.534] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0033.534] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.535] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="..", cAlternateFileName="")) returned 1 [0033.535] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="Low", cAlternateFileName="")) returned 1 [0033.535] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.535] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="..", cAlternateFileName="")) returned 1 [0033.535] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="..", cAlternateFileName="")) returned 0 [0033.535] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.535] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="Low", cAlternateFileName="")) returned 0 [0033.535] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.535] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1 [0033.535] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.536] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="..", cAlternateFileName="")) returned 1 [0033.536] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="index.dat", cAlternateFileName="")) returned 1 [0033.536] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="Low", cAlternateFileName="")) returned 1 [0033.536] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.536] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="..", cAlternateFileName="")) returned 1 [0033.536] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="index.dat", cAlternateFileName="")) returned 1 [0033.536] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x5d0e78, dwReserved1=0x18ea04, cFileName="index.dat", cAlternateFileName="")) returned 0 [0033.536] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.536] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="Low", cAlternateFileName="")) returned 0 [0033.536] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.536] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0033.536] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.536] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="..", cAlternateFileName="")) returned 1 [0033.536] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x6c61685f, dwReserved1=0x78636d70, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.537] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 0x6 [0033.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.537] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x112, lpOverlapped=0x0) returned 1 [0033.538] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x112, lpOverlapped=0x0) returned 1 [0033.539] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.539] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.539] CloseHandle (hObject=0xfc) returned 1 [0033.539] CloseHandle (hObject=0x104) returned 1 [0033.540] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.crypt")) returned 0 [0033.540] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.crypt")) returned 0x2020 [0033.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0033.540] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.540] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.540] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 1 [0033.541] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 0xffffffff [0033.541] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d1e12e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1 [0033.541] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1 [0033.541] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe23, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1 [0033.541] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1 [0033.542] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0033.542] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.542] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0033.542] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.542] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.542] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.542] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.543] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0033.543] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.543] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.543] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.544] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.544] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0033.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.544] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.544] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x94fde710, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0033.544] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0033.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.544] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.545] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0xaa, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0033.545] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0xaa, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0033.545] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.545] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0033.545] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0033.545] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x99b24c40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99b24c40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Recent", cAlternateFileName="")) returned 1 [0033.545] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x99b24c40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99b24c40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0033.545] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x99b24c40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99b24c40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.545] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f67800, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96f67800, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96f67800, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1429, dwReserved0=0x0, dwReserved1=0x0, cFileName="0hBeYEF7Ft4.mkv.lnk", cAlternateFileName="0HBEYE~1.LNK")) returned 1 [0033.545] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0hBeYEF7Ft4.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0hbeyef7ft4.mkv.lnk")) returned 0x20 [0033.545] VirtualAlloc (lpAddress=0x3104000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3104000 [0033.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0hBeYEF7Ft4.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0hbeyef7ft4.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.546] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0hBeYEF7Ft4.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0hbeyef7ft4.mkv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.546] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0033.547] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0033.548] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x429, lpOverlapped=0x0) returned 1 [0033.548] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x429, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x429, lpOverlapped=0x0) returned 1 [0033.548] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.548] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.548] CloseHandle (hObject=0x104) returned 1 [0033.548] CloseHandle (hObject=0xfc) returned 1 [0033.561] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0hBeYEF7Ft4.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0hbeyef7ft4.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0hBeYEF7Ft4.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0hbeyef7ft4.mkv.lnk.crypt")) returned 0 [0033.562] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0hBeYEF7Ft4.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0hbeyef7ft4.mkv.lnk.crypt")) returned 0x20 [0033.562] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0hBeYEF7Ft4.mkv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f67800, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96f67800, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96f67800, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1429, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="0hBeYEF7Ft4.mkv.lnk", cAlternateFileName="0HBEYE~1.LNK")) returned 0x5c8f80 [0033.562] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f67800, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96f67800, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96f67800, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1429, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="0hBeYEF7Ft4.mkv.lnk", cAlternateFileName="0HBEYE~1.LNK")) returned 0 [0033.562] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.562] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0hBeYEF7Ft4.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0hbeyef7ft4.mkv.lnk")) returned 1 [0033.563] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0hBeYEF7Ft4.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\0hbeyef7ft4.mkv.lnk")) returned 0xffffffff [0033.563] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972874e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x972874e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x972874e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="1k4R.lnk", cAlternateFileName="")) returned 1 [0033.563] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1k4R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1k4r.lnk")) returned 0x20 [0033.563] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1k4R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1k4r.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.563] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1k4R.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1k4r.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.564] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x9d5, lpOverlapped=0x0) returned 1 [0033.565] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x9d5, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x9d5, lpOverlapped=0x0) returned 1 [0033.566] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.566] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.566] CloseHandle (hObject=0xfc) returned 1 [0033.566] CloseHandle (hObject=0x104) returned 1 [0033.567] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1k4R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1k4r.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1k4R.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1k4r.lnk.crypt")) returned 0 [0033.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1k4R.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1k4r.lnk.crypt")) returned 0x20 [0033.567] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1k4R.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972874e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x972874e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x972874e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="1k4R.lnk", cAlternateFileName="")) returned 0x5c8f80 [0033.567] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972874e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x972874e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x972874e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="1k4R.lnk", cAlternateFileName="")) returned 0 [0033.567] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.567] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1k4R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1k4r.lnk")) returned 1 [0033.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1k4R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1k4r.lnk")) returned 0xffffffff [0033.568] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x988b21c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x988b21c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x988b21c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="1lgdOtiNG.lnk", cAlternateFileName="1LGDOT~1.LNK")) returned 1 [0033.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lgdOtiNG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1lgdoting.lnk")) returned 0x20 [0033.569] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lgdOtiNG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1lgdoting.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.569] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lgdOtiNG.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1lgdoting.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.569] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa21, lpOverlapped=0x0) returned 1 [0033.570] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa21, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa21, lpOverlapped=0x0) returned 1 [0033.571] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.571] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.571] CloseHandle (hObject=0x104) returned 1 [0033.571] CloseHandle (hObject=0xfc) returned 1 [0033.572] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lgdOtiNG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1lgdoting.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lgdOtiNG.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1lgdoting.lnk.crypt")) returned 0 [0033.572] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lgdOtiNG.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1lgdoting.lnk.crypt")) returned 0x20 [0033.572] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lgdOtiNG.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x988b21c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x988b21c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x988b21c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="1lgdOtiNG.lnk", cAlternateFileName="1LGDOT~1.LNK")) returned 0x5c8f80 [0033.572] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x988b21c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x988b21c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x988b21c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="1lgdOtiNG.lnk", cAlternateFileName="1LGDOT~1.LNK")) returned 0 [0033.572] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.572] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lgdOtiNG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1lgdoting.lnk")) returned 1 [0033.573] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lgdOtiNG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1lgdoting.lnk")) returned 0xffffffff [0033.573] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d78620, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96d78620, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96d78620, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="2-v8OsluyXo6NQ.lnk", cAlternateFileName="2-V8OS~1.LNK")) returned 1 [0033.573] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2-v8OsluyXo6NQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2-v8osluyxo6nq.lnk")) returned 0x20 [0033.573] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2-v8OsluyXo6NQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2-v8osluyxo6nq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.574] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2-v8OsluyXo6NQ.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2-v8osluyxo6nq.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.574] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa5c, lpOverlapped=0x0) returned 1 [0033.575] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa5c, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa5c, lpOverlapped=0x0) returned 1 [0033.576] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.576] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.576] CloseHandle (hObject=0xfc) returned 1 [0033.576] CloseHandle (hObject=0x104) returned 1 [0033.576] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2-v8OsluyXo6NQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2-v8osluyxo6nq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2-v8OsluyXo6NQ.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2-v8osluyxo6nq.lnk.crypt")) returned 0 [0033.577] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2-v8OsluyXo6NQ.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2-v8osluyxo6nq.lnk.crypt")) returned 0x20 [0033.577] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2-v8OsluyXo6NQ.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d78620, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96d78620, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96d78620, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="2-v8OsluyXo6NQ.lnk", cAlternateFileName="2-V8OS~1.LNK")) returned 0x5c8f80 [0033.577] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d78620, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96d78620, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96d78620, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="2-v8OsluyXo6NQ.lnk", cAlternateFileName="2-V8OS~1.LNK")) returned 0 [0033.577] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.577] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2-v8OsluyXo6NQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2-v8osluyxo6nq.lnk")) returned 1 [0033.578] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2-v8OsluyXo6NQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2-v8osluyxo6nq.lnk")) returned 0xffffffff [0033.578] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9990f900, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9990f900, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9990f900, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="20w83dwa.lnk", cAlternateFileName="")) returned 1 [0033.578] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\20w83dwa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\20w83dwa.lnk")) returned 0x20 [0033.578] VirtualAlloc (lpAddress=0x3108000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3108000 [0033.578] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\20w83dwa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\20w83dwa.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.579] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\20w83dwa.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\20w83dwa.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.579] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x239, lpOverlapped=0x0) returned 1 [0033.868] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x239, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x239, lpOverlapped=0x0) returned 1 [0033.869] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.869] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.869] CloseHandle (hObject=0x104) returned 1 [0033.869] CloseHandle (hObject=0xfc) returned 1 [0033.871] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\20w83dwa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\20w83dwa.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\20w83dwa.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\20w83dwa.lnk.crypt")) returned 0 [0033.871] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\20w83dwa.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\20w83dwa.lnk.crypt")) returned 0x20 [0033.871] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\20w83dwa.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9990f900, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9990f900, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9990f900, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="20w83dwa.lnk", cAlternateFileName="")) returned 0x5c8f80 [0033.872] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9990f900, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9990f900, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9990f900, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="20w83dwa.lnk", cAlternateFileName="")) returned 0 [0033.872] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.872] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\20w83dwa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\20w83dwa.lnk")) returned 1 [0033.873] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\20w83dwa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\20w83dwa.lnk")) returned 0xffffffff [0033.873] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98cdc840, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98cdc840, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98cdc840, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Qy9fNpQyCJ 70GH9.lnk", cAlternateFileName="2QY9FN~1.LNK")) returned 1 [0033.873] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2Qy9fNpQyCJ 70GH9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2qy9fnpqycj 70gh9.lnk")) returned 0x20 [0033.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2Qy9fNpQyCJ 70GH9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2qy9fnpqycj 70gh9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2Qy9fNpQyCJ 70GH9.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2qy9fnpqycj 70gh9.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.901] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa84, lpOverlapped=0x0) returned 1 [0033.902] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa84, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa84, lpOverlapped=0x0) returned 1 [0033.902] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.902] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.903] CloseHandle (hObject=0xfc) returned 1 [0033.903] CloseHandle (hObject=0x104) returned 1 [0033.904] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2Qy9fNpQyCJ 70GH9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2qy9fnpqycj 70gh9.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2Qy9fNpQyCJ 70GH9.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2qy9fnpqycj 70gh9.lnk.crypt")) returned 0 [0033.904] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2Qy9fNpQyCJ 70GH9.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2qy9fnpqycj 70gh9.lnk.crypt")) returned 0x20 [0033.904] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2Qy9fNpQyCJ 70GH9.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98cdc840, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98cdc840, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98cdc840, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="2Qy9fNpQyCJ 70GH9.lnk", cAlternateFileName="2QY9FN~1.LNK")) returned 0x5c8f80 [0033.904] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98cdc840, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98cdc840, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98cdc840, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="2Qy9fNpQyCJ 70GH9.lnk", cAlternateFileName="2QY9FN~1.LNK")) returned 0 [0033.904] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.904] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2Qy9fNpQyCJ 70GH9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2qy9fnpqycj 70gh9.lnk")) returned 1 [0033.905] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2Qy9fNpQyCJ 70GH9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2qy9fnpqycj 70gh9.lnk")) returned 0xffffffff [0033.905] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x985b8640, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x985b8640, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98676d20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1002, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="2YTf5ryi8j8c45B6Xqk1.lnk", cAlternateFileName="2YTF5R~1.LNK")) returned 1 [0033.905] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YTf5ryi8j8c45B6Xqk1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2ytf5ryi8j8c45b6xqk1.lnk")) returned 0x20 [0033.906] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YTf5ryi8j8c45B6Xqk1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2ytf5ryi8j8c45b6xqk1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.906] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YTf5ryi8j8c45B6Xqk1.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2ytf5ryi8j8c45b6xqk1.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.906] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0033.907] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0033.908] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x2, lpOverlapped=0x0) returned 1 [0033.908] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x2, lpOverlapped=0x0) returned 1 [0033.908] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.909] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.909] CloseHandle (hObject=0x104) returned 1 [0033.909] CloseHandle (hObject=0xfc) returned 1 [0033.909] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YTf5ryi8j8c45B6Xqk1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2ytf5ryi8j8c45b6xqk1.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YTf5ryi8j8c45B6Xqk1.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2ytf5ryi8j8c45b6xqk1.lnk.crypt")) returned 0 [0033.910] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YTf5ryi8j8c45B6Xqk1.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2ytf5ryi8j8c45b6xqk1.lnk.crypt")) returned 0x20 [0033.910] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YTf5ryi8j8c45B6Xqk1.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x985b8640, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x985b8640, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98676d20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1002, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="2YTf5ryi8j8c45B6Xqk1.lnk", cAlternateFileName="2YTF5R~1.LNK")) returned 0x5c8f80 [0033.910] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x985b8640, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x985b8640, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98676d20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1002, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="2YTf5ryi8j8c45B6Xqk1.lnk", cAlternateFileName="2YTF5R~1.LNK")) returned 0 [0033.910] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.910] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YTf5ryi8j8c45B6Xqk1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2ytf5ryi8j8c45b6xqk1.lnk")) returned 1 [0033.911] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YTf5ryi8j8c45B6Xqk1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2ytf5ryi8j8c45b6xqk1.lnk")) returned 0xffffffff [0033.911] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9787abe0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9787abe0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9787abe0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa88, dwReserved0=0x5d0e78, dwReserved1=0x18ec6c, cFileName="3bgp1RW3KcVuB5mMAG.lnk", cAlternateFileName="3BGP1R~1.LNK")) returned 1 [0033.911] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3bgp1RW3KcVuB5mMAG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3bgp1rw3kcvub5mmag.lnk")) returned 0x20 [0033.911] VirtualAlloc (lpAddress=0x310c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x310c000 [0033.911] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3bgp1RW3KcVuB5mMAG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3bgp1rw3kcvub5mmag.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.912] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3bgp1RW3KcVuB5mMAG.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3bgp1rw3kcvub5mmag.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.912] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa88, lpOverlapped=0x0) returned 1 [0033.913] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa88, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa88, lpOverlapped=0x0) returned 1 [0033.914] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.914] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.914] CloseHandle (hObject=0xfc) returned 1 [0033.914] CloseHandle (hObject=0x104) returned 1 [0033.915] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3bgp1RW3KcVuB5mMAG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3bgp1rw3kcvub5mmag.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3bgp1RW3KcVuB5mMAG.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3bgp1rw3kcvub5mmag.lnk.crypt")) returned 0 [0033.915] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3bgp1RW3KcVuB5mMAG.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3bgp1rw3kcvub5mmag.lnk.crypt")) returned 0x20 [0033.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3bgp1RW3KcVuB5mMAG.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9787abe0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9787abe0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9787abe0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa88, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="3bgp1RW3KcVuB5mMAG.lnk", cAlternateFileName="3BGP1R~1.LNK")) returned 0x5c8f80 [0033.915] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9787abe0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9787abe0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9787abe0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa88, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="3bgp1RW3KcVuB5mMAG.lnk", cAlternateFileName="3BGP1R~1.LNK")) returned 0 [0033.915] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.915] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3bgp1RW3KcVuB5mMAG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3bgp1rw3kcvub5mmag.lnk")) returned 1 [0033.916] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3bgp1RW3KcVuB5mMAG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3bgp1rw3kcvub5mmag.lnk")) returned 0xffffffff [0033.916] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970721a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9912d020, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9912d020, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="4WR0EV8pyK_9X.lnk", cAlternateFileName="4WR0EV~1.LNK")) returned 1 [0033.916] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WR0EV8pyK_9X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4wr0ev8pyk_9x.lnk")) returned 0x20 [0033.916] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WR0EV8pyK_9X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4wr0ev8pyk_9x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.916] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WR0EV8pyK_9X.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4wr0ev8pyk_9x.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.917] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x980, lpOverlapped=0x0) returned 1 [0033.918] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x980, lpOverlapped=0x0) returned 1 [0033.919] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.919] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.919] CloseHandle (hObject=0x104) returned 1 [0033.919] CloseHandle (hObject=0xfc) returned 1 [0033.919] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WR0EV8pyK_9X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4wr0ev8pyk_9x.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WR0EV8pyK_9X.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4wr0ev8pyk_9x.lnk.crypt")) returned 0 [0033.920] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WR0EV8pyK_9X.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4wr0ev8pyk_9x.lnk.crypt")) returned 0x20 [0033.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WR0EV8pyK_9X.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970721a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9912d020, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9912d020, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="4WR0EV8pyK_9X.lnk", cAlternateFileName="4WR0EV~1.LNK")) returned 0x5c8f80 [0033.920] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970721a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9912d020, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9912d020, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="4WR0EV8pyK_9X.lnk", cAlternateFileName="4WR0EV~1.LNK")) returned 0 [0033.920] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.920] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WR0EV8pyK_9X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4wr0ev8pyk_9x.lnk")) returned 1 [0033.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4WR0EV8pyK_9X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4wr0ev8pyk_9x.lnk")) returned 0xffffffff [0033.921] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d4ec60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98d4ec60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98d4ec60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf31, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="63lPZq3SNnHAORv23yF.flv.lnk", cAlternateFileName="63LPZQ~1.LNK")) returned 1 [0033.921] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\63lPZq3SNnHAORv23yF.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\63lpzq3snnhaorv23yf.flv.lnk")) returned 0x20 [0033.921] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\63lPZq3SNnHAORv23yF.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\63lpzq3snnhaorv23yf.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.921] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\63lPZq3SNnHAORv23yF.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\63lpzq3snnhaorv23yf.flv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.922] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xf31, lpOverlapped=0x0) returned 1 [0033.923] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xf31, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xf31, lpOverlapped=0x0) returned 1 [0033.924] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.924] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.924] CloseHandle (hObject=0xfc) returned 1 [0033.924] CloseHandle (hObject=0x104) returned 1 [0033.925] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\63lPZq3SNnHAORv23yF.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\63lpzq3snnhaorv23yf.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\63lPZq3SNnHAORv23yF.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\63lpzq3snnhaorv23yf.flv.lnk.crypt")) returned 0 [0033.925] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\63lPZq3SNnHAORv23yF.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\63lpzq3snnhaorv23yf.flv.lnk.crypt")) returned 0x20 [0033.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\63lPZq3SNnHAORv23yF.flv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d4ec60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98d4ec60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98d4ec60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf31, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="63lPZq3SNnHAORv23yF.flv.lnk", cAlternateFileName="63LPZQ~1.LNK")) returned 0x5c8f80 [0033.925] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d4ec60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98d4ec60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98d4ec60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf31, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="63lPZq3SNnHAORv23yF.flv.lnk", cAlternateFileName="63LPZQ~1.LNK")) returned 0 [0033.925] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.925] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\63lPZq3SNnHAORv23yF.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\63lpzq3snnhaorv23yf.flv.lnk")) returned 1 [0033.929] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\63lPZq3SNnHAORv23yF.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\63lpzq3snnhaorv23yf.flv.lnk")) returned 0xffffffff [0033.929] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x996ae300, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996ae300, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996ae300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x0, cFileName="6AMH.mkv.lnk", cAlternateFileName="6AMHMK~1.LNK")) returned 1 [0033.929] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6AMH.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6amh.mkv.lnk")) returned 0x20 [0033.929] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6AMH.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6amh.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.929] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6AMH.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6amh.mkv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.930] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xe88, lpOverlapped=0x0) returned 1 [0033.931] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xe88, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xe88, lpOverlapped=0x0) returned 1 [0033.932] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.932] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.932] CloseHandle (hObject=0x104) returned 1 [0033.932] CloseHandle (hObject=0xfc) returned 1 [0033.933] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6AMH.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6amh.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6AMH.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6amh.mkv.lnk.crypt")) returned 0 [0033.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6AMH.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6amh.mkv.lnk.crypt")) returned 0x20 [0033.933] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6AMH.mkv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x996ae300, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996ae300, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996ae300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="6AMH.mkv.lnk", cAlternateFileName="6AMHMK~1.LNK")) returned 0x5c8f80 [0033.933] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x996ae300, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996ae300, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996ae300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="6AMH.mkv.lnk", cAlternateFileName="6AMHMK~1.LNK")) returned 0 [0033.933] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.933] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6AMH.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6amh.mkv.lnk")) returned 1 [0033.934] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6AMH.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6amh.mkv.lnk")) returned 0xffffffff [0033.934] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9818dfc0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9818dfc0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9818dfc0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="6c5qlTBS.lnk", cAlternateFileName="")) returned 1 [0033.934] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6c5qlTBS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6c5qltbs.lnk")) returned 0x20 [0033.934] VirtualAlloc (lpAddress=0x3110000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3110000 [0033.934] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6c5qlTBS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6c5qltbs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.935] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6c5qlTBS.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6c5qltbs.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.935] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x3b6, lpOverlapped=0x0) returned 1 [0033.936] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x3b6, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x3b6, lpOverlapped=0x0) returned 1 [0033.937] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.937] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.937] CloseHandle (hObject=0xfc) returned 1 [0033.937] CloseHandle (hObject=0x104) returned 1 [0033.937] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6c5qlTBS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6c5qltbs.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6c5qlTBS.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6c5qltbs.lnk.crypt")) returned 0 [0033.938] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6c5qlTBS.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6c5qltbs.lnk.crypt")) returned 0x20 [0033.938] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6c5qlTBS.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9818dfc0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9818dfc0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9818dfc0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3b6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="6c5qlTBS.lnk", cAlternateFileName="")) returned 0x5c8f80 [0033.938] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9818dfc0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9818dfc0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9818dfc0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3b6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="6c5qlTBS.lnk", cAlternateFileName="")) returned 0 [0033.938] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.938] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6c5qlTBS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6c5qltbs.lnk")) returned 1 [0033.946] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6c5qlTBS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6c5qltbs.lnk")) returned 0xffffffff [0033.946] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f3de40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f3de40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f3de40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x0, dwReserved1=0x0, cFileName="7H_dTpHa.lnk", cAlternateFileName="")) returned 1 [0033.946] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7H_dTpHa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7h_dtpha.lnk")) returned 0x20 [0033.946] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7H_dTpHa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7h_dtpha.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.946] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7H_dTpHa.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7h_dtpha.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.947] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa21, lpOverlapped=0x0) returned 1 [0033.947] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa21, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa21, lpOverlapped=0x0) returned 1 [0033.948] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.948] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.948] CloseHandle (hObject=0x104) returned 1 [0033.948] CloseHandle (hObject=0xfc) returned 1 [0033.950] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7H_dTpHa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7h_dtpha.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7H_dTpHa.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7h_dtpha.lnk.crypt")) returned 0 [0033.950] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7H_dTpHa.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7h_dtpha.lnk.crypt")) returned 0x20 [0033.950] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7H_dTpHa.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f3de40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f3de40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f3de40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="7H_dTpHa.lnk", cAlternateFileName="")) returned 0x5c8f80 [0033.950] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f3de40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f3de40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f3de40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="7H_dTpHa.lnk", cAlternateFileName="")) returned 0 [0033.950] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.950] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7H_dTpHa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7h_dtpha.lnk")) returned 1 [0033.951] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7H_dTpHa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7h_dtpha.lnk")) returned 0xffffffff [0033.951] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b85be0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98b85be0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98b85be0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7pxElmPL-Wwhu0MBGln.lnk", cAlternateFileName="7PXELM~1.LNK")) returned 1 [0033.951] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7pxElmPL-Wwhu0MBGln.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7pxelmpl-wwhu0mbgln.lnk")) returned 0x20 [0033.951] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7pxElmPL-Wwhu0MBGln.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7pxelmpl-wwhu0mbgln.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.951] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7pxElmPL-Wwhu0MBGln.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7pxelmpl-wwhu0mbgln.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.952] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa7a, lpOverlapped=0x0) returned 1 [0033.953] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa7a, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa7a, lpOverlapped=0x0) returned 1 [0033.954] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.954] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.954] CloseHandle (hObject=0xfc) returned 1 [0033.954] CloseHandle (hObject=0x104) returned 1 [0033.955] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7pxElmPL-Wwhu0MBGln.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7pxelmpl-wwhu0mbgln.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7pxElmPL-Wwhu0MBGln.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7pxelmpl-wwhu0mbgln.lnk.crypt")) returned 0 [0033.955] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7pxElmPL-Wwhu0MBGln.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7pxelmpl-wwhu0mbgln.lnk.crypt")) returned 0x20 [0033.955] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7pxElmPL-Wwhu0MBGln.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b85be0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98b85be0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98b85be0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="7pxElmPL-Wwhu0MBGln.lnk", cAlternateFileName="7PXELM~1.LNK")) returned 0x5c8f80 [0033.955] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b85be0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98b85be0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98b85be0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="7pxElmPL-Wwhu0MBGln.lnk", cAlternateFileName="7PXELM~1.LNK")) returned 0 [0033.955] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.956] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7pxElmPL-Wwhu0MBGln.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7pxelmpl-wwhu0mbgln.lnk")) returned 1 [0033.956] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7pxElmPL-Wwhu0MBGln.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7pxelmpl-wwhu0mbgln.lnk")) returned 0xffffffff [0033.956] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97723f80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97723f80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9774a0e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="7r-1o.lnk", cAlternateFileName="")) returned 1 [0033.957] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7r-1o.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7r-1o.lnk")) returned 0x20 [0033.957] VirtualAlloc (lpAddress=0x3114000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3114000 [0033.957] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7r-1o.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7r-1o.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.957] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7r-1o.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7r-1o.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.958] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x226, lpOverlapped=0x0) returned 1 [0033.958] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x226, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x226, lpOverlapped=0x0) returned 1 [0033.959] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.959] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.959] CloseHandle (hObject=0x104) returned 1 [0033.959] CloseHandle (hObject=0xfc) returned 1 [0033.960] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7r-1o.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7r-1o.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7r-1o.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7r-1o.lnk.crypt")) returned 0 [0033.960] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7r-1o.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7r-1o.lnk.crypt")) returned 0x20 [0033.960] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7r-1o.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97723f80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97723f80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9774a0e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="7r-1o.lnk", cAlternateFileName="")) returned 0x5c8f80 [0033.960] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97723f80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97723f80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9774a0e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="7r-1o.lnk", cAlternateFileName="")) returned 0 [0033.960] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.961] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7r-1o.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7r-1o.lnk")) returned 1 [0033.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7r-1o.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7r-1o.lnk")) returned 0xffffffff [0033.961] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97feb0a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97feb0a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97feb0a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x0, cFileName="a zSKVxRNzq.lnk", cAlternateFileName="AZSKVX~1.LNK")) returned 1 [0033.961] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a zSKVxRNzq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a zskvxrnzq.lnk")) returned 0x20 [0033.962] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a zSKVxRNzq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a zskvxrnzq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.962] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a zSKVxRNzq.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a zskvxrnzq.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.962] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x248, lpOverlapped=0x0) returned 1 [0033.963] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x248, lpOverlapped=0x0) returned 1 [0033.964] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.964] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.964] CloseHandle (hObject=0xfc) returned 1 [0033.964] CloseHandle (hObject=0x104) returned 1 [0033.965] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a zSKVxRNzq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a zskvxrnzq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a zSKVxRNzq.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a zskvxrnzq.lnk.crypt")) returned 0 [0033.965] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a zSKVxRNzq.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a zskvxrnzq.lnk.crypt")) returned 0x20 [0033.965] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a zSKVxRNzq.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97feb0a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97feb0a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97feb0a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="a zSKVxRNzq.lnk", cAlternateFileName="AZSKVX~1.LNK")) returned 0x5c8f80 [0033.965] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97feb0a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97feb0a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97feb0a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="a zSKVxRNzq.lnk", cAlternateFileName="AZSKVX~1.LNK")) returned 0 [0033.965] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.965] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a zSKVxRNzq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a zskvxrnzq.lnk")) returned 1 [0033.966] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a zSKVxRNzq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\a zskvxrnzq.lnk")) returned 0xffffffff [0033.966] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fb0260, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98fb0260, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98fb0260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACyV4Fg44jp6azL.lnk", cAlternateFileName="ACYV4F~1.LNK")) returned 1 [0033.966] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ACyV4Fg44jp6azL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\acyv4fg44jp6azl.lnk")) returned 0x20 [0033.966] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ACyV4Fg44jp6azL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\acyv4fg44jp6azl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.967] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ACyV4Fg44jp6azL.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\acyv4fg44jp6azl.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.967] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa63, lpOverlapped=0x0) returned 1 [0033.968] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa63, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa63, lpOverlapped=0x0) returned 1 [0033.978] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.978] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.978] CloseHandle (hObject=0x104) returned 1 [0033.978] CloseHandle (hObject=0xfc) returned 1 [0033.979] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ACyV4Fg44jp6azL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\acyv4fg44jp6azl.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ACyV4Fg44jp6azL.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\acyv4fg44jp6azl.lnk.crypt")) returned 0 [0033.979] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ACyV4Fg44jp6azL.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\acyv4fg44jp6azl.lnk.crypt")) returned 0x20 [0033.979] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ACyV4Fg44jp6azL.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fb0260, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98fb0260, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98fb0260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="ACyV4Fg44jp6azL.lnk", cAlternateFileName="ACYV4F~1.LNK")) returned 0x5c8f80 [0033.979] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fb0260, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98fb0260, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98fb0260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="ACyV4Fg44jp6azL.lnk", cAlternateFileName="ACYV4F~1.LNK")) returned 0 [0033.979] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.980] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ACyV4Fg44jp6azL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\acyv4fg44jp6azl.lnk")) returned 1 [0033.980] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ACyV4Fg44jp6azL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\acyv4fg44jp6azl.lnk")) returned 0xffffffff [0033.980] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9906e940, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9906e940, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9906e940, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x0, cFileName="aIhTDD.lnk", cAlternateFileName="")) returned 1 [0033.981] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aIhTDD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aihtdd.lnk")) returned 0x20 [0033.981] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aIhTDD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aihtdd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.981] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aIhTDD.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aihtdd.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.981] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa04, lpOverlapped=0x0) returned 1 [0033.982] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa04, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa04, lpOverlapped=0x0) returned 1 [0033.983] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.983] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.983] CloseHandle (hObject=0xfc) returned 1 [0033.983] CloseHandle (hObject=0x104) returned 1 [0033.984] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aIhTDD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aihtdd.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aIhTDD.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aihtdd.lnk.crypt")) returned 0 [0033.984] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aIhTDD.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aihtdd.lnk.crypt")) returned 0x20 [0033.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aIhTDD.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9906e940, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9906e940, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9906e940, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="aIhTDD.lnk", cAlternateFileName="")) returned 0x5c8f80 [0033.984] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9906e940, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9906e940, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9906e940, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="aIhTDD.lnk", cAlternateFileName="")) returned 0 [0033.984] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.984] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aIhTDD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aihtdd.lnk")) returned 1 [0033.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aIhTDD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aihtdd.lnk")) returned 0xffffffff [0033.986] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97f52b20, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97f52b20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97f52b20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALdqrxGRhqPLE.flv.lnk", cAlternateFileName="ALDQRX~1.LNK")) returned 1 [0033.986] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ALdqrxGRhqPLE.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aldqrxgrhqple.flv.lnk")) returned 0x20 [0033.986] VirtualAlloc (lpAddress=0x3118000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3118000 [0033.986] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ALdqrxGRhqPLE.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aldqrxgrhqple.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.986] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ALdqrxGRhqPLE.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aldqrxgrhqple.flv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.987] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x3cf, lpOverlapped=0x0) returned 1 [0033.988] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x3cf, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x3cf, lpOverlapped=0x0) returned 1 [0033.988] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.988] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.988] CloseHandle (hObject=0x104) returned 1 [0033.989] CloseHandle (hObject=0xfc) returned 1 [0033.989] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ALdqrxGRhqPLE.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aldqrxgrhqple.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ALdqrxGRhqPLE.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aldqrxgrhqple.flv.lnk.crypt")) returned 0 [0033.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ALdqrxGRhqPLE.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aldqrxgrhqple.flv.lnk.crypt")) returned 0x20 [0033.989] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ALdqrxGRhqPLE.flv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97f52b20, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97f52b20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97f52b20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="ALdqrxGRhqPLE.flv.lnk", cAlternateFileName="ALDQRX~1.LNK")) returned 0x5c8f80 [0033.990] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97f52b20, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97f52b20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97f52b20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="ALdqrxGRhqPLE.flv.lnk", cAlternateFileName="ALDQRX~1.LNK")) returned 0 [0033.990] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.990] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ALdqrxGRhqPLE.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aldqrxgrhqple.flv.lnk")) returned 1 [0033.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ALdqrxGRhqPLE.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aldqrxgrhqple.flv.lnk")) returned 0xffffffff [0033.991] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0033.991] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0033.991] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.991] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x991c3660, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0xb8, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0033.991] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa5f178d0, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0xb8, dwReserved1=0x0, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0033.991] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xb8, dwReserved1=0x0, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 1 [0033.991] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0xb8, dwReserved1=0x0, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 0 [0033.991] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.991] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98487b40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98487b40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98487b40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13f2, dwReserved0=0x38626434, dwReserved1=0x75612e37, cFileName="av6EJhj6daw.flv.lnk", cAlternateFileName="AV6EJH~1.LNK")) returned 1 [0033.991] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\av6EJhj6daw.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\av6ejhj6daw.flv.lnk")) returned 0x20 [0033.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\av6EJhj6daw.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\av6ejhj6daw.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.992] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\av6EJhj6daw.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\av6ejhj6daw.flv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.992] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0033.993] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0033.994] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x3f2, lpOverlapped=0x0) returned 1 [0033.994] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x3f2, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x3f2, lpOverlapped=0x0) returned 1 [0033.994] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.994] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.994] CloseHandle (hObject=0xfc) returned 1 [0033.994] CloseHandle (hObject=0x104) returned 1 [0033.995] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\av6EJhj6daw.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\av6ejhj6daw.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\av6EJhj6daw.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\av6ejhj6daw.flv.lnk.crypt")) returned 0 [0033.995] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\av6EJhj6daw.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\av6ejhj6daw.flv.lnk.crypt")) returned 0x20 [0033.995] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\av6EJhj6daw.flv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98487b40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98487b40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98487b40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13f2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="av6EJhj6daw.flv.lnk", cAlternateFileName="AV6EJH~1.LNK")) returned 0x5c8f80 [0033.996] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98487b40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98487b40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98487b40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13f2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="av6EJhj6daw.flv.lnk", cAlternateFileName="AV6EJH~1.LNK")) returned 0 [0033.996] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0033.996] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\av6EJhj6daw.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\av6ejhj6daw.flv.lnk")) returned 1 [0033.997] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\av6EJhj6daw.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\av6ejhj6daw.flv.lnk")) returned 0xffffffff [0033.997] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f67800, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99b24c40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99b24c40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="b ylBYEH0cothr-.lnk", cAlternateFileName="BYLBYE~1.LNK")) returned 1 [0033.997] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b ylBYEH0cothr-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b ylbyeh0cothr-.lnk")) returned 0x20 [0033.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b ylBYEH0cothr-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b ylbyeh0cothr-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0033.997] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b ylBYEH0cothr-.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b ylbyeh0cothr-.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0033.998] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1f8, lpOverlapped=0x0) returned 1 [0033.998] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1f8, lpOverlapped=0x0) returned 1 [0033.999] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.999] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0033.999] CloseHandle (hObject=0x104) returned 1 [0033.999] CloseHandle (hObject=0xfc) returned 1 [0034.000] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b ylBYEH0cothr-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b ylbyeh0cothr-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b ylBYEH0cothr-.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b ylbyeh0cothr-.lnk.crypt")) returned 0 [0034.000] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b ylBYEH0cothr-.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b ylbyeh0cothr-.lnk.crypt")) returned 0x20 [0034.000] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b ylBYEH0cothr-.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f67800, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99b24c40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99b24c40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="b ylBYEH0cothr-.lnk", cAlternateFileName="BYLBYE~1.LNK")) returned 0x5c8f80 [0034.000] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f67800, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99b24c40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99b24c40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="b ylBYEH0cothr-.lnk", cAlternateFileName="BYLBYE~1.LNK")) returned 0 [0034.000] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.000] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b ylBYEH0cothr-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b ylbyeh0cothr-.lnk")) returned 1 [0034.001] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b ylBYEH0cothr-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b ylbyeh0cothr-.lnk")) returned 0xffffffff [0034.002] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98de71e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98de71e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98de71e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x31a, dwReserved0=0x0, dwReserved1=0x0, cFileName="B320plYDi698XfAex.lnk", cAlternateFileName="B320PL~1.LNK")) returned 1 [0034.002] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B320plYDi698XfAex.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b320plydi698xfaex.lnk")) returned 0x20 [0034.002] VirtualAlloc (lpAddress=0x311c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x311c000 [0034.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B320plYDi698XfAex.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b320plydi698xfaex.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.002] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B320plYDi698XfAex.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b320plydi698xfaex.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.003] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x31a, lpOverlapped=0x0) returned 1 [0034.003] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x31a, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x31a, lpOverlapped=0x0) returned 1 [0034.004] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.004] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.004] CloseHandle (hObject=0xfc) returned 1 [0034.004] CloseHandle (hObject=0x104) returned 1 [0034.005] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B320plYDi698XfAex.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b320plydi698xfaex.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B320plYDi698XfAex.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b320plydi698xfaex.lnk.crypt")) returned 0 [0034.005] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B320plYDi698XfAex.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b320plydi698xfaex.lnk.crypt")) returned 0x20 [0034.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B320plYDi698XfAex.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98de71e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98de71e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98de71e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x31a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="B320plYDi698XfAex.lnk", cAlternateFileName="B320PL~1.LNK")) returned 0x5c8f80 [0034.005] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98de71e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98de71e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98de71e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x31a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="B320plYDi698XfAex.lnk", cAlternateFileName="B320PL~1.LNK")) returned 0 [0034.005] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.006] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B320plYDi698XfAex.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b320plydi698xfaex.lnk")) returned 1 [0034.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B320plYDi698XfAex.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b320plydi698xfaex.lnk")) returned 0xffffffff [0034.006] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9837d1a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9837d1a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9837d1a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf10, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="B77Jv1PcIX8nKuV-.mkv.lnk", cAlternateFileName="B77JV1~1.LNK")) returned 1 [0034.006] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B77Jv1PcIX8nKuV-.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b77jv1pcix8nkuv-.mkv.lnk")) returned 0x20 [0034.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B77Jv1PcIX8nKuV-.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b77jv1pcix8nkuv-.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B77Jv1PcIX8nKuV-.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b77jv1pcix8nkuv-.mkv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.015] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xf10, lpOverlapped=0x0) returned 1 [0034.016] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xf10, lpOverlapped=0x0) returned 1 [0034.016] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.017] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.017] CloseHandle (hObject=0x104) returned 1 [0034.017] CloseHandle (hObject=0xfc) returned 1 [0034.018] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B77Jv1PcIX8nKuV-.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b77jv1pcix8nkuv-.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B77Jv1PcIX8nKuV-.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b77jv1pcix8nkuv-.mkv.lnk.crypt")) returned 0 [0034.018] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B77Jv1PcIX8nKuV-.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b77jv1pcix8nkuv-.mkv.lnk.crypt")) returned 0x20 [0034.018] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B77Jv1PcIX8nKuV-.mkv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9837d1a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9837d1a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9837d1a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf10, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="B77Jv1PcIX8nKuV-.mkv.lnk", cAlternateFileName="B77JV1~1.LNK")) returned 0x5c8f80 [0034.018] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9837d1a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9837d1a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9837d1a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf10, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="B77Jv1PcIX8nKuV-.mkv.lnk", cAlternateFileName="B77JV1~1.LNK")) returned 0 [0034.018] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.018] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B77Jv1PcIX8nKuV-.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b77jv1pcix8nkuv-.mkv.lnk")) returned 1 [0034.019] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B77Jv1PcIX8nKuV-.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\b77jv1pcix8nkuv-.mkv.lnk")) returned 0xffffffff [0034.019] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9717cb40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9717cb40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9717cb40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="BEOeKw eDuhD3.lnk", cAlternateFileName="BEOEKW~1.LNK")) returned 1 [0034.020] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEOeKw eDuhD3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\beoekw eduhd3.lnk")) returned 0x20 [0034.020] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEOeKw eDuhD3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\beoekw eduhd3.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.020] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEOeKw eDuhD3.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\beoekw eduhd3.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.020] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa58, lpOverlapped=0x0) returned 1 [0034.021] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa58, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa58, lpOverlapped=0x0) returned 1 [0034.022] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.022] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.022] CloseHandle (hObject=0xfc) returned 1 [0034.022] CloseHandle (hObject=0x104) returned 1 [0034.023] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEOeKw eDuhD3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\beoekw eduhd3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEOeKw eDuhD3.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\beoekw eduhd3.lnk.crypt")) returned 0 [0034.023] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEOeKw eDuhD3.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\beoekw eduhd3.lnk.crypt")) returned 0x20 [0034.023] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEOeKw eDuhD3.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9717cb40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9717cb40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9717cb40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="BEOeKw eDuhD3.lnk", cAlternateFileName="BEOEKW~1.LNK")) returned 0x5c8f80 [0034.023] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9717cb40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9717cb40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9717cb40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="BEOeKw eDuhD3.lnk", cAlternateFileName="BEOEKW~1.LNK")) returned 0 [0034.023] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.023] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEOeKw eDuhD3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\beoekw eduhd3.lnk")) returned 1 [0034.024] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEOeKw eDuhD3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\beoekw eduhd3.lnk")) returned 0xffffffff [0034.024] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99720720, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99720720, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99720720, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="bhUHT.lnk", cAlternateFileName="")) returned 1 [0034.024] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bhUHT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhuht.lnk")) returned 0x20 [0034.025] VirtualAlloc (lpAddress=0x3120000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3120000 [0034.025] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bhUHT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhuht.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.025] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bhUHT.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhuht.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.026] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x3d5, lpOverlapped=0x0) returned 1 [0034.026] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x3d5, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x3d5, lpOverlapped=0x0) returned 1 [0034.027] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.027] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.027] CloseHandle (hObject=0x104) returned 1 [0034.027] CloseHandle (hObject=0xfc) returned 1 [0034.028] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bhUHT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhuht.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bhUHT.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhuht.lnk.crypt")) returned 0 [0034.028] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bhUHT.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhuht.lnk.crypt")) returned 0x20 [0034.028] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bhUHT.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99720720, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99720720, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99720720, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="bhUHT.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.028] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99720720, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99720720, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99720720, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="bhUHT.lnk", cAlternateFileName="")) returned 0 [0034.028] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.028] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bhUHT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhuht.lnk")) returned 1 [0034.029] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bhUHT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bhuht.lnk")) returned 0xffffffff [0034.029] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997dee00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x997dee00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x997dee00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BTGLO1I4z9S60.mkv.lnk", cAlternateFileName="BTGLO1~1.LNK")) returned 1 [0034.029] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTGLO1I4z9S60.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\btglo1i4z9s60.mkv.lnk")) returned 0x20 [0034.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTGLO1I4z9S60.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\btglo1i4z9s60.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTGLO1I4z9S60.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\btglo1i4z9s60.mkv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.030] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x9f9, lpOverlapped=0x0) returned 1 [0034.031] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x9f9, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x9f9, lpOverlapped=0x0) returned 1 [0034.032] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.032] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.033] CloseHandle (hObject=0xfc) returned 1 [0034.033] CloseHandle (hObject=0x104) returned 1 [0034.033] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTGLO1I4z9S60.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\btglo1i4z9s60.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTGLO1I4z9S60.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\btglo1i4z9s60.mkv.lnk.crypt")) returned 0 [0034.033] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTGLO1I4z9S60.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\btglo1i4z9s60.mkv.lnk.crypt")) returned 0x20 [0034.033] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTGLO1I4z9S60.mkv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997dee00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x997dee00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x997dee00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="BTGLO1I4z9S60.mkv.lnk", cAlternateFileName="BTGLO1~1.LNK")) returned 0x5c8f80 [0034.034] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997dee00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x997dee00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x997dee00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="BTGLO1I4z9S60.mkv.lnk", cAlternateFileName="BTGLO1~1.LNK")) returned 0 [0034.034] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.034] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTGLO1I4z9S60.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\btglo1i4z9s60.mkv.lnk")) returned 1 [0034.035] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BTGLO1I4z9S60.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\btglo1i4z9s60.mkv.lnk")) returned 0xffffffff [0034.035] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fb0260, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98fb0260, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98fb0260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Ck22L.lnk", cAlternateFileName="")) returned 1 [0034.035] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck22L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck22l.lnk")) returned 0x20 [0034.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck22L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck22l.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck22L.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck22l.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.036] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x9f1, lpOverlapped=0x0) returned 1 [0034.036] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x9f1, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x9f1, lpOverlapped=0x0) returned 1 [0034.037] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.037] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.037] CloseHandle (hObject=0x104) returned 1 [0034.037] CloseHandle (hObject=0xfc) returned 1 [0034.038] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck22L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck22l.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck22L.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck22l.lnk.crypt")) returned 0 [0034.038] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck22L.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck22l.lnk.crypt")) returned 0x20 [0034.038] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck22L.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fb0260, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98fb0260, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98fb0260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Ck22L.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.038] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fb0260, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98fb0260, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98fb0260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Ck22L.lnk", cAlternateFileName="")) returned 0 [0034.038] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.039] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck22L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck22l.lnk")) returned 1 [0034.039] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck22L.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck22l.lnk")) returned 0xffffffff [0034.039] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96a7eaa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96a7eaa0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96a7eaa0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x144b, dwReserved0=0x0, dwReserved1=0x0, cFileName="clzlnKg2DDD.mkv.lnk", cAlternateFileName="CLZLNK~1.LNK")) returned 1 [0034.040] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\clzlnKg2DDD.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\clzlnkg2ddd.mkv.lnk")) returned 0x20 [0034.040] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\clzlnKg2DDD.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\clzlnkg2ddd.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.040] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\clzlnKg2DDD.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\clzlnkg2ddd.mkv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.040] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.041] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.042] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x44b, lpOverlapped=0x0) returned 1 [0034.042] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x44b, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x44b, lpOverlapped=0x0) returned 1 [0034.042] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.042] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.042] CloseHandle (hObject=0xfc) returned 1 [0034.042] CloseHandle (hObject=0x104) returned 1 [0034.044] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\clzlnKg2DDD.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\clzlnkg2ddd.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\clzlnKg2DDD.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\clzlnkg2ddd.mkv.lnk.crypt")) returned 0 [0034.045] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\clzlnKg2DDD.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\clzlnkg2ddd.mkv.lnk.crypt")) returned 0x20 [0034.045] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\clzlnKg2DDD.mkv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96a7eaa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96a7eaa0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96a7eaa0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x144b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="clzlnKg2DDD.mkv.lnk", cAlternateFileName="CLZLNK~1.LNK")) returned 0x5c8f80 [0034.045] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96a7eaa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96a7eaa0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96a7eaa0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x144b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="clzlnKg2DDD.mkv.lnk", cAlternateFileName="CLZLNK~1.LNK")) returned 0 [0034.045] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.045] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\clzlnKg2DDD.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\clzlnkg2ddd.mkv.lnk")) returned 1 [0034.046] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\clzlnKg2DDD.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\clzlnkg2ddd.mkv.lnk")) returned 0xffffffff [0034.046] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9919f440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9919f440, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9919f440, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x0, dwReserved1=0x0, cFileName="cSpgQsUvdWcqqW_4G8m.lnk", cAlternateFileName="CSPGQS~1.LNK")) returned 1 [0034.046] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSpgQsUvdWcqqW_4G8m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cspgqsuvdwcqqw_4g8m.lnk")) returned 0x20 [0034.046] VirtualAlloc (lpAddress=0x3124000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3124000 [0034.046] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSpgQsUvdWcqqW_4G8m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cspgqsuvdwcqqw_4g8m.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.047] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSpgQsUvdWcqqW_4G8m.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cspgqsuvdwcqqw_4g8m.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.047] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x270, lpOverlapped=0x0) returned 1 [0034.048] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x270, lpOverlapped=0x0) returned 1 [0034.049] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.049] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.049] CloseHandle (hObject=0x104) returned 1 [0034.049] CloseHandle (hObject=0xfc) returned 1 [0034.050] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSpgQsUvdWcqqW_4G8m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cspgqsuvdwcqqw_4g8m.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSpgQsUvdWcqqW_4G8m.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cspgqsuvdwcqqw_4g8m.lnk.crypt")) returned 0 [0034.050] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSpgQsUvdWcqqW_4G8m.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cspgqsuvdwcqqw_4g8m.lnk.crypt")) returned 0x20 [0034.050] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSpgQsUvdWcqqW_4G8m.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9919f440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9919f440, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9919f440, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="cSpgQsUvdWcqqW_4G8m.lnk", cAlternateFileName="CSPGQS~1.LNK")) returned 0x5c8f80 [0034.050] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9919f440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9919f440, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9919f440, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="cSpgQsUvdWcqqW_4G8m.lnk", cAlternateFileName="CSPGQS~1.LNK")) returned 0 [0034.050] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.050] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSpgQsUvdWcqqW_4G8m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cspgqsuvdwcqqw_4g8m.lnk")) returned 1 [0034.051] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSpgQsUvdWcqqW_4G8m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cspgqsuvdwcqqw_4g8m.lnk")) returned 0xffffffff [0034.051] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x978a0d40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x978a0d40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x978a0d40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="ctgIJ7lZLN2CGput Xl.ots.lnk", cAlternateFileName="CTGIJ7~1.LNK")) returned 1 [0034.051] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ctgIJ7lZLN2CGput Xl.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ctgij7lzln2cgput xl.ots.lnk")) returned 0x20 [0034.052] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ctgIJ7lZLN2CGput Xl.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ctgij7lzln2cgput xl.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.052] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ctgIJ7lZLN2CGput Xl.ots.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ctgij7lzln2cgput xl.ots.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.052] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa6e, lpOverlapped=0x0) returned 1 [0034.053] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa6e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa6e, lpOverlapped=0x0) returned 1 [0034.054] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.054] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.054] CloseHandle (hObject=0xfc) returned 1 [0034.054] CloseHandle (hObject=0x104) returned 1 [0034.055] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ctgIJ7lZLN2CGput Xl.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ctgij7lzln2cgput xl.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ctgIJ7lZLN2CGput Xl.ots.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ctgij7lzln2cgput xl.ots.lnk.crypt")) returned 0 [0034.055] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ctgIJ7lZLN2CGput Xl.ots.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ctgij7lzln2cgput xl.ots.lnk.crypt")) returned 0x20 [0034.055] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ctgIJ7lZLN2CGput Xl.ots.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x978a0d40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x978a0d40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x978a0d40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="ctgIJ7lZLN2CGput Xl.ots.lnk", cAlternateFileName="CTGIJ7~1.LNK")) returned 0x5c8f80 [0034.055] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x978a0d40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x978a0d40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x978a0d40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="ctgIJ7lZLN2CGput Xl.ots.lnk", cAlternateFileName="CTGIJ7~1.LNK")) returned 0 [0034.055] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.055] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ctgIJ7lZLN2CGput Xl.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ctgij7lzln2cgput xl.ots.lnk")) returned 1 [0034.056] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ctgIJ7lZLN2CGput Xl.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ctgij7lzln2cgput xl.ots.lnk")) returned 0xffffffff [0034.056] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0034.056] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0034.057] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.057] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0xc4, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0034.057] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0xc4, dwReserved1=0x0, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0034.057] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0xc4, dwReserved1=0x0, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0034.057] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0xc4, dwReserved1=0x0, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 1 [0034.057] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0xc4, dwReserved1=0x0, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0034.057] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0xc4, dwReserved1=0x0, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 1 [0034.058] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0xc4, dwReserved1=0x0, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 1 [0034.058] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0xc4, dwReserved1=0x0, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0 [0034.058] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.058] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fd63c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98fd63c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98fd63c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x32396337, dwReserved1=0x75632e39, cFileName="czX2gsVPMSP9d.lnk", cAlternateFileName="CZX2GS~1.LNK")) returned 1 [0034.058] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\czX2gsVPMSP9d.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\czx2gsvpmsp9d.lnk")) returned 0x20 [0034.058] VirtualAlloc (lpAddress=0x3128000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3128000 [0034.059] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\czX2gsVPMSP9d.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\czx2gsvpmsp9d.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.059] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\czX2gsVPMSP9d.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\czx2gsvpmsp9d.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.060] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa38, lpOverlapped=0x0) returned 1 [0034.061] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa38, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa38, lpOverlapped=0x0) returned 1 [0034.062] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.062] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.062] CloseHandle (hObject=0x104) returned 1 [0034.062] CloseHandle (hObject=0xfc) returned 1 [0034.086] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\czX2gsVPMSP9d.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\czx2gsvpmsp9d.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\czX2gsVPMSP9d.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\czx2gsvpmsp9d.lnk.crypt")) returned 0 [0034.086] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\czX2gsVPMSP9d.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\czx2gsvpmsp9d.lnk.crypt")) returned 0x20 [0034.086] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\czX2gsVPMSP9d.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fd63c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98fd63c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98fd63c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="czX2gsVPMSP9d.lnk", cAlternateFileName="CZX2GS~1.LNK")) returned 0x5c8f80 [0034.086] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fd63c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98fd63c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98fd63c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="czX2gsVPMSP9d.lnk", cAlternateFileName="CZX2GS~1.LNK")) returned 0 [0034.086] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.086] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\czX2gsVPMSP9d.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\czx2gsvpmsp9d.lnk")) returned 1 [0034.087] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\czX2gsVPMSP9d.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\czx2gsvpmsp9d.lnk")) returned 0xffffffff [0034.087] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9982b0c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9982b0c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9982b0c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0zcRpw_caOcZNoV4mkG.lnk", cAlternateFileName="D0ZCRP~1.LNK")) returned 1 [0034.087] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D0zcRpw_caOcZNoV4mkG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d0zcrpw_caocznov4mkg.lnk")) returned 0x20 [0034.088] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D0zcRpw_caOcZNoV4mkG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d0zcrpw_caocznov4mkg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.088] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D0zcRpw_caOcZNoV4mkG.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d0zcrpw_caocznov4mkg.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.088] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x424, lpOverlapped=0x0) returned 1 [0034.089] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x424, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x424, lpOverlapped=0x0) returned 1 [0034.090] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.090] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.090] CloseHandle (hObject=0xfc) returned 1 [0034.090] CloseHandle (hObject=0x104) returned 1 [0034.091] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D0zcRpw_caOcZNoV4mkG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d0zcrpw_caocznov4mkg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D0zcRpw_caOcZNoV4mkG.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d0zcrpw_caocznov4mkg.lnk.crypt")) returned 0 [0034.091] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D0zcRpw_caOcZNoV4mkG.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d0zcrpw_caocznov4mkg.lnk.crypt")) returned 0x20 [0034.091] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D0zcRpw_caOcZNoV4mkG.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9982b0c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9982b0c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9982b0c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="D0zcRpw_caOcZNoV4mkG.lnk", cAlternateFileName="D0ZCRP~1.LNK")) returned 0x5c8f80 [0034.091] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9982b0c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9982b0c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9982b0c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="D0zcRpw_caOcZNoV4mkG.lnk", cAlternateFileName="D0ZCRP~1.LNK")) returned 0 [0034.091] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.091] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D0zcRpw_caOcZNoV4mkG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d0zcrpw_caocznov4mkg.lnk")) returned 1 [0034.092] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D0zcRpw_caOcZNoV4mkG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d0zcrpw_caocznov4mkg.lnk")) returned 0xffffffff [0034.092] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.092] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 0x6 [0034.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.093] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.093] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1b0, lpOverlapped=0x0) returned 1 [0034.094] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1b0, lpOverlapped=0x0) returned 1 [0034.095] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.095] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.095] CloseHandle (hObject=0x104) returned 1 [0034.095] CloseHandle (hObject=0xfc) returned 1 [0034.096] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.crypt")) returned 0 [0034.096] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.crypt")) returned 0x20 [0034.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0034.096] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.096] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.096] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 1 [0034.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 0xffffffff [0034.097] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969c03c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x969c03c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x969c03c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x0, dwReserved1=0x0, cFileName="DXvVoXwv.lnk", cAlternateFileName="")) returned 1 [0034.097] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXvVoXwv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxvvoxwv.lnk")) returned 0x20 [0034.097] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXvVoXwv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxvvoxwv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXvVoXwv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxvvoxwv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.098] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa21, lpOverlapped=0x0) returned 1 [0034.099] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa21, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa21, lpOverlapped=0x0) returned 1 [0034.100] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.100] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.100] CloseHandle (hObject=0xfc) returned 1 [0034.100] CloseHandle (hObject=0x104) returned 1 [0034.101] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXvVoXwv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxvvoxwv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXvVoXwv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxvvoxwv.lnk.crypt")) returned 0 [0034.101] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXvVoXwv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxvvoxwv.lnk.crypt")) returned 0x20 [0034.102] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXvVoXwv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969c03c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x969c03c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x969c03c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="DXvVoXwv.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.102] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969c03c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x969c03c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x969c03c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="DXvVoXwv.lnk", cAlternateFileName="")) returned 0 [0034.102] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.102] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXvVoXwv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxvvoxwv.lnk")) returned 1 [0034.103] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DXvVoXwv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxvvoxwv.lnk")) returned 0xffffffff [0034.103] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97261380, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99a40400, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99a40400, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa06, dwReserved0=0x0, dwReserved1=0x0, cFileName="EbgPE9V15_kcIv3u6EhR.lnk", cAlternateFileName="EBGPE9~1.LNK")) returned 1 [0034.103] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EbgPE9V15_kcIv3u6EhR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ebgpe9v15_kciv3u6ehr.lnk")) returned 0x20 [0034.103] VirtualAlloc (lpAddress=0x312c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x312c000 [0034.103] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EbgPE9V15_kcIv3u6EhR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ebgpe9v15_kciv3u6ehr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.103] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EbgPE9V15_kcIv3u6EhR.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ebgpe9v15_kciv3u6ehr.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.104] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa06, lpOverlapped=0x0) returned 1 [0034.105] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa06, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa06, lpOverlapped=0x0) returned 1 [0034.106] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.106] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.106] CloseHandle (hObject=0x104) returned 1 [0034.106] CloseHandle (hObject=0xfc) returned 1 [0034.107] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EbgPE9V15_kcIv3u6EhR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ebgpe9v15_kciv3u6ehr.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EbgPE9V15_kcIv3u6EhR.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ebgpe9v15_kciv3u6ehr.lnk.crypt")) returned 0 [0034.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EbgPE9V15_kcIv3u6EhR.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ebgpe9v15_kciv3u6ehr.lnk.crypt")) returned 0x20 [0034.107] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EbgPE9V15_kcIv3u6EhR.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97261380, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99a40400, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99a40400, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa06, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="EbgPE9V15_kcIv3u6EhR.lnk", cAlternateFileName="EBGPE9~1.LNK")) returned 0x5c8f80 [0034.107] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97261380, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99a40400, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99a40400, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa06, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="EbgPE9V15_kcIv3u6EhR.lnk", cAlternateFileName="EBGPE9~1.LNK")) returned 0 [0034.107] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.107] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EbgPE9V15_kcIv3u6EhR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ebgpe9v15_kciv3u6ehr.lnk")) returned 1 [0034.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EbgPE9V15_kcIv3u6EhR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ebgpe9v15_kciv3u6ehr.lnk")) returned 0xffffffff [0034.108] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98e334a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98e334a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98e334a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="eMhUXRXBgUglxcn3.lnk", cAlternateFileName="EMHUXR~1.LNK")) returned 1 [0034.108] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eMhUXRXBgUglxcn3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emhuxrxbguglxcn3.lnk")) returned 0x20 [0034.108] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eMhUXRXBgUglxcn3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emhuxrxbguglxcn3.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eMhUXRXBgUglxcn3.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emhuxrxbguglxcn3.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.109] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x410, lpOverlapped=0x0) returned 1 [0034.110] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x410, lpOverlapped=0x0) returned 1 [0034.111] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.111] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.111] CloseHandle (hObject=0xfc) returned 1 [0034.111] CloseHandle (hObject=0x104) returned 1 [0034.112] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eMhUXRXBgUglxcn3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emhuxrxbguglxcn3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eMhUXRXBgUglxcn3.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emhuxrxbguglxcn3.lnk.crypt")) returned 0 [0034.112] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eMhUXRXBgUglxcn3.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emhuxrxbguglxcn3.lnk.crypt")) returned 0x20 [0034.112] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eMhUXRXBgUglxcn3.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98e334a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98e334a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98e334a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="eMhUXRXBgUglxcn3.lnk", cAlternateFileName="EMHUXR~1.LNK")) returned 0x5c8f80 [0034.112] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98e334a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98e334a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98e334a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="eMhUXRXBgUglxcn3.lnk", cAlternateFileName="EMHUXR~1.LNK")) returned 0 [0034.112] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.112] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eMhUXRXBgUglxcn3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emhuxrxbguglxcn3.lnk")) returned 1 [0034.113] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eMhUXRXBgUglxcn3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emhuxrxbguglxcn3.lnk")) returned 0xffffffff [0034.113] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984f9f60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x984f9f60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x984f9f60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x0, dwReserved1=0x0, cFileName="eovezfgn1Aazt5.lnk", cAlternateFileName="EOVEZF~1.LNK")) returned 1 [0034.113] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eovezfgn1Aazt5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eovezfgn1aazt5.lnk")) returned 0x20 [0034.113] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eovezfgn1Aazt5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eovezfgn1aazt5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.113] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eovezfgn1Aazt5.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eovezfgn1aazt5.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.114] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa47, lpOverlapped=0x0) returned 1 [0034.115] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa47, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa47, lpOverlapped=0x0) returned 1 [0034.116] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.116] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.116] CloseHandle (hObject=0x104) returned 1 [0034.116] CloseHandle (hObject=0xfc) returned 1 [0034.116] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eovezfgn1Aazt5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eovezfgn1aazt5.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eovezfgn1Aazt5.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eovezfgn1aazt5.lnk.crypt")) returned 0 [0034.117] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eovezfgn1Aazt5.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eovezfgn1aazt5.lnk.crypt")) returned 0x20 [0034.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eovezfgn1Aazt5.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984f9f60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x984f9f60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x984f9f60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="eovezfgn1Aazt5.lnk", cAlternateFileName="EOVEZF~1.LNK")) returned 0x5c8f80 [0034.117] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984f9f60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x984f9f60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x984f9f60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="eovezfgn1Aazt5.lnk", cAlternateFileName="EOVEZF~1.LNK")) returned 0 [0034.117] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.117] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eovezfgn1Aazt5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eovezfgn1aazt5.lnk")) returned 1 [0034.118] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eovezfgn1Aazt5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\eovezfgn1aazt5.lnk")) returned 0xffffffff [0034.118] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972d37a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x972d37a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x972d37a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="et hDjezCTkvEK.lnk", cAlternateFileName="ETHDJE~1.LNK")) returned 1 [0034.118] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\et hDjezCTkvEK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\et hdjezctkvek.lnk")) returned 0x20 [0034.118] VirtualAlloc (lpAddress=0x3130000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3130000 [0034.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\et hDjezCTkvEK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\et hdjezctkvek.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.119] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\et hDjezCTkvEK.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\et hdjezctkvek.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.119] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x257, lpOverlapped=0x0) returned 1 [0034.120] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x257, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x257, lpOverlapped=0x0) returned 1 [0034.121] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.121] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.121] CloseHandle (hObject=0xfc) returned 1 [0034.121] CloseHandle (hObject=0x104) returned 1 [0034.122] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\et hDjezCTkvEK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\et hdjezctkvek.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\et hDjezCTkvEK.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\et hdjezctkvek.lnk.crypt")) returned 0 [0034.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\et hDjezCTkvEK.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\et hdjezctkvek.lnk.crypt")) returned 0x20 [0034.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\et hDjezCTkvEK.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972d37a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x972d37a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x972d37a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="et hDjezCTkvEK.lnk", cAlternateFileName="ETHDJE~1.LNK")) returned 0x5c8f80 [0034.122] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972d37a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x972d37a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x972d37a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="et hDjezCTkvEK.lnk", cAlternateFileName="ETHDJE~1.LNK")) returned 0 [0034.122] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.122] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\et hDjezCTkvEK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\et hdjezctkvek.lnk")) returned 1 [0034.123] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\et hDjezCTkvEK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\et hdjezctkvek.lnk")) returned 0xffffffff [0034.123] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x988b21c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x988b21c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x988b21c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="fgkJ1j.lnk", cAlternateFileName="")) returned 1 [0034.123] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fgkJ1j.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fgkj1j.lnk")) returned 0x20 [0034.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fgkJ1j.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fgkj1j.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.123] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fgkJ1j.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fgkj1j.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.124] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa0b, lpOverlapped=0x0) returned 1 [0034.125] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa0b, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa0b, lpOverlapped=0x0) returned 1 [0034.126] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.127] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.127] CloseHandle (hObject=0x104) returned 1 [0034.127] CloseHandle (hObject=0xfc) returned 1 [0034.128] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fgkJ1j.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fgkj1j.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fgkJ1j.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fgkj1j.lnk.crypt")) returned 0 [0034.128] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fgkJ1j.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fgkj1j.lnk.crypt")) returned 0x20 [0034.128] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fgkJ1j.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x988b21c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x988b21c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x988b21c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa0b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="fgkJ1j.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.128] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x988b21c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x988b21c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x988b21c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa0b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="fgkJ1j.lnk", cAlternateFileName="")) returned 0 [0034.128] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.128] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fgkJ1j.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fgkj1j.lnk")) returned 1 [0034.129] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fgkJ1j.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fgkj1j.lnk")) returned 0xffffffff [0034.129] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b89440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96b89440, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96b89440, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa22, dwReserved0=0x0, dwReserved1=0x0, cFileName="FtJuB8_WULa.lnk", cAlternateFileName="FTJUB8~1.LNK")) returned 1 [0034.129] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtJuB8_WULa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ftjub8_wula.lnk")) returned 0x20 [0034.129] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtJuB8_WULa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ftjub8_wula.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.129] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtJuB8_WULa.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ftjub8_wula.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.130] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa22, lpOverlapped=0x0) returned 1 [0034.131] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa22, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa22, lpOverlapped=0x0) returned 1 [0034.132] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.132] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.132] CloseHandle (hObject=0xfc) returned 1 [0034.132] CloseHandle (hObject=0x104) returned 1 [0034.132] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtJuB8_WULa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ftjub8_wula.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtJuB8_WULa.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ftjub8_wula.lnk.crypt")) returned 0 [0034.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtJuB8_WULa.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ftjub8_wula.lnk.crypt")) returned 0x20 [0034.133] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtJuB8_WULa.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b89440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96b89440, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96b89440, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa22, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="FtJuB8_WULa.lnk", cAlternateFileName="FTJUB8~1.LNK")) returned 0x5c8f80 [0034.133] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b89440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96b89440, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96b89440, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa22, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="FtJuB8_WULa.lnk", cAlternateFileName="FTJUB8~1.LNK")) returned 0 [0034.133] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.133] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtJuB8_WULa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ftjub8_wula.lnk")) returned 1 [0034.134] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FtJuB8_WULa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ftjub8_wula.lnk")) returned 0xffffffff [0034.134] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99804f60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99804f60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99804f60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa72, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gepf8q naWWdA3Hh.lnk", cAlternateFileName="GEPF8Q~1.LNK")) returned 1 [0034.134] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gepf8q naWWdA3Hh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gepf8q nawwda3hh.lnk")) returned 0x20 [0034.134] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gepf8q naWWdA3Hh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gepf8q nawwda3hh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.134] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gepf8q naWWdA3Hh.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gepf8q nawwda3hh.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.135] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa72, lpOverlapped=0x0) returned 1 [0034.136] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa72, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa72, lpOverlapped=0x0) returned 1 [0034.137] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.137] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.137] CloseHandle (hObject=0x104) returned 1 [0034.137] CloseHandle (hObject=0xfc) returned 1 [0034.137] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gepf8q naWWdA3Hh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gepf8q nawwda3hh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gepf8q naWWdA3Hh.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gepf8q nawwda3hh.lnk.crypt")) returned 0 [0034.138] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gepf8q naWWdA3Hh.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gepf8q nawwda3hh.lnk.crypt")) returned 0x20 [0034.138] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gepf8q naWWdA3Hh.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99804f60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99804f60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99804f60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa72, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Gepf8q naWWdA3Hh.lnk", cAlternateFileName="GEPF8Q~1.LNK")) returned 0x5c8f80 [0034.138] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99804f60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99804f60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99804f60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa72, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Gepf8q naWWdA3Hh.lnk", cAlternateFileName="GEPF8Q~1.LNK")) returned 0 [0034.138] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.138] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gepf8q naWWdA3Hh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gepf8q nawwda3hh.lnk")) returned 1 [0034.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gepf8q naWWdA3Hh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gepf8q nawwda3hh.lnk")) returned 0xffffffff [0034.139] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f8a100, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f8a100, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f8a100, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="gjcKm.lnk", cAlternateFileName="")) returned 1 [0034.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gjcKm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gjckm.lnk")) returned 0x20 [0034.139] VirtualAlloc (lpAddress=0x3134000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3134000 [0034.139] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gjcKm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gjckm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.139] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gjcKm.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gjckm.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.140] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x226, lpOverlapped=0x0) returned 1 [0034.141] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x226, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x226, lpOverlapped=0x0) returned 1 [0034.142] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.142] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.142] CloseHandle (hObject=0xfc) returned 1 [0034.142] CloseHandle (hObject=0x104) returned 1 [0034.142] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gjcKm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gjckm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gjcKm.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gjckm.lnk.crypt")) returned 0 [0034.143] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gjcKm.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gjckm.lnk.crypt")) returned 0x20 [0034.143] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gjcKm.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f8a100, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f8a100, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f8a100, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="gjcKm.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.143] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f8a100, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f8a100, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f8a100, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="gjcKm.lnk", cAlternateFileName="")) returned 0 [0034.143] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.143] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gjcKm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gjckm.lnk")) returned 1 [0034.144] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gjcKm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gjckm.lnk")) returned 0xffffffff [0034.144] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971a2ca0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x971a2ca0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x971a2ca0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x0, dwReserved1=0x0, cFileName="gOVPRFjodhzZVtG.lnk", cAlternateFileName="GOVPRF~1.LNK")) returned 1 [0034.144] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOVPRFjodhzZVtG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\govprfjodhzzvtg.lnk")) returned 0x20 [0034.144] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOVPRFjodhzZVtG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\govprfjodhzzvtg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.144] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOVPRFjodhzZVtG.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\govprfjodhzzvtg.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.145] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa63, lpOverlapped=0x0) returned 1 [0034.146] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa63, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa63, lpOverlapped=0x0) returned 1 [0034.147] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.147] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.147] CloseHandle (hObject=0x104) returned 1 [0034.147] CloseHandle (hObject=0xfc) returned 1 [0034.147] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOVPRFjodhzZVtG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\govprfjodhzzvtg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOVPRFjodhzZVtG.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\govprfjodhzzvtg.lnk.crypt")) returned 0 [0034.148] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOVPRFjodhzZVtG.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\govprfjodhzzvtg.lnk.crypt")) returned 0x20 [0034.148] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOVPRFjodhzZVtG.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971a2ca0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x971a2ca0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x971a2ca0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="gOVPRFjodhzZVtG.lnk", cAlternateFileName="GOVPRF~1.LNK")) returned 0x5c8f80 [0034.148] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971a2ca0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x971a2ca0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x971a2ca0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="gOVPRFjodhzZVtG.lnk", cAlternateFileName="GOVPRF~1.LNK")) returned 0 [0034.148] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.148] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOVPRFjodhzZVtG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\govprfjodhzzvtg.lnk")) returned 1 [0034.149] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gOVPRFjodhzZVtG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\govprfjodhzzvtg.lnk")) returned 0xffffffff [0034.149] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x982e4c20, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x982e4c20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x982e4c20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf55, dwReserved0=0x0, dwReserved1=0x0, cFileName="grU9T.lnk", cAlternateFileName="")) returned 1 [0034.149] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\grU9T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gru9t.lnk")) returned 0x20 [0034.149] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\grU9T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gru9t.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.149] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\grU9T.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gru9t.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.150] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xf55, lpOverlapped=0x0) returned 1 [0034.151] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xf55, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xf55, lpOverlapped=0x0) returned 1 [0034.151] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.151] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.151] CloseHandle (hObject=0xfc) returned 1 [0034.151] CloseHandle (hObject=0x104) returned 1 [0034.152] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\grU9T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gru9t.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\grU9T.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gru9t.lnk.crypt")) returned 0 [0034.152] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\grU9T.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gru9t.lnk.crypt")) returned 0x20 [0034.152] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\grU9T.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x982e4c20, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x982e4c20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x982e4c20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf55, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="grU9T.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.153] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x982e4c20, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x982e4c20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x982e4c20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf55, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="grU9T.lnk", cAlternateFileName="")) returned 0 [0034.153] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.153] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\grU9T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gru9t.lnk")) returned 1 [0034.154] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\grU9T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gru9t.lnk")) returned 0xffffffff [0034.154] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x996ae300, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996ae300, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996ae300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="gWma.lnk", cAlternateFileName="")) returned 1 [0034.154] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWma.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwma.lnk")) returned 0x20 [0034.154] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWma.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwma.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.154] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWma.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwma.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.155] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x9f1, lpOverlapped=0x0) returned 1 [0034.156] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x9f1, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x9f1, lpOverlapped=0x0) returned 1 [0034.156] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.156] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.157] CloseHandle (hObject=0x104) returned 1 [0034.157] CloseHandle (hObject=0xfc) returned 1 [0034.158] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWma.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwma.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWma.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwma.lnk.crypt")) returned 0 [0034.158] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWma.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwma.lnk.crypt")) returned 0x20 [0034.158] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWma.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x996ae300, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996ae300, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996ae300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="gWma.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.158] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x996ae300, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996ae300, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996ae300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="gWma.lnk", cAlternateFileName="")) returned 0 [0034.158] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.159] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWma.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwma.lnk")) returned 1 [0034.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gWma.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gwma.lnk")) returned 0xffffffff [0034.159] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97f2c9c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97f2c9c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97f2c9c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="I f1ZnX-HR.lnk", cAlternateFileName="IF1ZNX~1.LNK")) returned 1 [0034.159] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I f1ZnX-HR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i f1znx-hr.lnk")) returned 0x20 [0034.160] VirtualAlloc (lpAddress=0x3138000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3138000 [0034.160] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I f1ZnX-HR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i f1znx-hr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.160] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I f1ZnX-HR.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i f1znx-hr.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.161] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa1b, lpOverlapped=0x0) returned 1 [0034.161] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa1b, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa1b, lpOverlapped=0x0) returned 1 [0034.162] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.162] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.163] CloseHandle (hObject=0xfc) returned 1 [0034.163] CloseHandle (hObject=0x104) returned 1 [0034.163] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I f1ZnX-HR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i f1znx-hr.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I f1ZnX-HR.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i f1znx-hr.lnk.crypt")) returned 0 [0034.163] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I f1ZnX-HR.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i f1znx-hr.lnk.crypt")) returned 0x20 [0034.164] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I f1ZnX-HR.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97f2c9c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97f2c9c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97f2c9c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="I f1ZnX-HR.lnk", cAlternateFileName="IF1ZNX~1.LNK")) returned 0x5c8f80 [0034.164] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97f2c9c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97f2c9c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97f2c9c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="I f1ZnX-HR.lnk", cAlternateFileName="IF1ZNX~1.LNK")) returned 0 [0034.164] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.164] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I f1ZnX-HR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i f1znx-hr.lnk")) returned 1 [0034.165] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I f1ZnX-HR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i f1znx-hr.lnk")) returned 0xffffffff [0034.165] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98226540, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98226540, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98226540, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x0, dwReserved1=0x0, cFileName="I8sW8qFtvHq_OBx.lnk", cAlternateFileName="I8SW8Q~1.LNK")) returned 1 [0034.165] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I8sW8qFtvHq_OBx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i8sw8qftvhq_obx.lnk")) returned 0x20 [0034.165] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I8sW8qFtvHq_OBx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i8sw8qftvhq_obx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.165] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I8sW8qFtvHq_OBx.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i8sw8qftvhq_obx.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.166] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa63, lpOverlapped=0x0) returned 1 [0034.166] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa63, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa63, lpOverlapped=0x0) returned 1 [0034.167] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.167] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.167] CloseHandle (hObject=0x104) returned 1 [0034.167] CloseHandle (hObject=0xfc) returned 1 [0034.168] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I8sW8qFtvHq_OBx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i8sw8qftvhq_obx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I8sW8qFtvHq_OBx.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i8sw8qftvhq_obx.lnk.crypt")) returned 0 [0034.168] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I8sW8qFtvHq_OBx.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i8sw8qftvhq_obx.lnk.crypt")) returned 0x20 [0034.168] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I8sW8qFtvHq_OBx.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98226540, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98226540, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98226540, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="I8sW8qFtvHq_OBx.lnk", cAlternateFileName="I8SW8Q~1.LNK")) returned 0x5c8f80 [0034.168] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98226540, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98226540, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98226540, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="I8sW8qFtvHq_OBx.lnk", cAlternateFileName="I8SW8Q~1.LNK")) returned 0 [0034.168] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.169] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I8sW8qFtvHq_OBx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i8sw8qftvhq_obx.lnk")) returned 1 [0034.169] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I8sW8qFtvHq_OBx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i8sw8qftvhq_obx.lnk")) returned 0xffffffff [0034.170] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97c58fa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97c58fa0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97c58fa0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="IJ5_x.flv.lnk", cAlternateFileName="IJ5_XF~1.LNK")) returned 1 [0034.170] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IJ5_x.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ij5_x.flv.lnk")) returned 0x20 [0034.170] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IJ5_x.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ij5_x.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.170] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IJ5_x.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ij5_x.flv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.170] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x226, lpOverlapped=0x0) returned 1 [0034.171] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x226, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x226, lpOverlapped=0x0) returned 1 [0034.172] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.172] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.172] CloseHandle (hObject=0xfc) returned 1 [0034.172] CloseHandle (hObject=0x104) returned 1 [0034.173] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IJ5_x.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ij5_x.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IJ5_x.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ij5_x.flv.lnk.crypt")) returned 0 [0034.174] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IJ5_x.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ij5_x.flv.lnk.crypt")) returned 0x20 [0034.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IJ5_x.flv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97c58fa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97c58fa0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97c58fa0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="IJ5_x.flv.lnk", cAlternateFileName="IJ5_XF~1.LNK")) returned 0x5c8f80 [0034.174] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97c58fa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97c58fa0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97c58fa0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="IJ5_x.flv.lnk", cAlternateFileName="IJ5_XF~1.LNK")) returned 0 [0034.174] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.174] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IJ5_x.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ij5_x.flv.lnk")) returned 1 [0034.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IJ5_x.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ij5_x.flv.lnk")) returned 0xffffffff [0034.175] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984619e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x984619e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x984619e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="itujVDK1.lnk", cAlternateFileName="")) returned 1 [0034.175] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\itujVDK1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itujvdk1.lnk")) returned 0x20 [0034.175] VirtualAlloc (lpAddress=0x313c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x313c000 [0034.175] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\itujVDK1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itujvdk1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.175] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\itujVDK1.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itujvdk1.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.176] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xf7e, lpOverlapped=0x0) returned 1 [0034.177] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xf7e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xf7e, lpOverlapped=0x0) returned 1 [0034.178] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.178] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.178] CloseHandle (hObject=0x104) returned 1 [0034.178] CloseHandle (hObject=0xfc) returned 1 [0034.179] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\itujVDK1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itujvdk1.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\itujVDK1.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itujvdk1.lnk.crypt")) returned 0 [0034.179] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\itujVDK1.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itujvdk1.lnk.crypt")) returned 0x20 [0034.179] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\itujVDK1.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984619e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x984619e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x984619e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="itujVDK1.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.179] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984619e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x984619e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x984619e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="itujVDK1.lnk", cAlternateFileName="")) returned 0 [0034.179] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.179] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\itujVDK1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itujvdk1.lnk")) returned 1 [0034.180] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\itujVDK1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itujvdk1.lnk")) returned 0xffffffff [0034.180] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98272800, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98272800, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98272800, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ixcTUA2MdhOdrM8T-je.lnk", cAlternateFileName="IXCTUA~1.LNK")) returned 1 [0034.180] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ixcTUA2MdhOdrM8T-je.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ixctua2mdhodrm8t-je.lnk")) returned 0x20 [0034.180] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ixcTUA2MdhOdrM8T-je.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ixctua2mdhodrm8t-je.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.181] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ixcTUA2MdhOdrM8T-je.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ixctua2mdhodrm8t-je.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.181] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa8f, lpOverlapped=0x0) returned 1 [0034.182] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa8f, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa8f, lpOverlapped=0x0) returned 1 [0034.183] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.183] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.183] CloseHandle (hObject=0xfc) returned 1 [0034.183] CloseHandle (hObject=0x104) returned 1 [0034.184] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ixcTUA2MdhOdrM8T-je.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ixctua2mdhodrm8t-je.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ixcTUA2MdhOdrM8T-je.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ixctua2mdhodrm8t-je.lnk.crypt")) returned 0 [0034.184] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ixcTUA2MdhOdrM8T-je.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ixctua2mdhodrm8t-je.lnk.crypt")) returned 0x20 [0034.184] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ixcTUA2MdhOdrM8T-je.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98272800, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98272800, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98272800, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="ixcTUA2MdhOdrM8T-je.lnk", cAlternateFileName="IXCTUA~1.LNK")) returned 0x5c8f80 [0034.184] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98272800, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98272800, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98272800, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="ixcTUA2MdhOdrM8T-je.lnk", cAlternateFileName="IXCTUA~1.LNK")) returned 0 [0034.184] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.184] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ixcTUA2MdhOdrM8T-je.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ixctua2mdhodrm8t-je.lnk")) returned 1 [0034.185] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ixcTUA2MdhOdrM8T-je.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ixctua2mdhodrm8t-je.lnk")) returned 0xffffffff [0034.185] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98996a00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98996a00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98996a00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="J3ZkluwvkiGXI8r-B5.lnk", cAlternateFileName="J3ZKLU~1.LNK")) returned 1 [0034.185] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J3ZkluwvkiGXI8r-B5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j3zkluwvkigxi8r-b5.lnk")) returned 0x20 [0034.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J3ZkluwvkiGXI8r-B5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j3zkluwvkigxi8r-b5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J3ZkluwvkiGXI8r-B5.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j3zkluwvkigxi8r-b5.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.186] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x41a, lpOverlapped=0x0) returned 1 [0034.187] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x41a, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x41a, lpOverlapped=0x0) returned 1 [0034.188] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.188] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.188] CloseHandle (hObject=0x104) returned 1 [0034.188] CloseHandle (hObject=0xfc) returned 1 [0034.189] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J3ZkluwvkiGXI8r-B5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j3zkluwvkigxi8r-b5.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J3ZkluwvkiGXI8r-B5.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j3zkluwvkigxi8r-b5.lnk.crypt")) returned 0 [0034.189] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J3ZkluwvkiGXI8r-B5.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j3zkluwvkigxi8r-b5.lnk.crypt")) returned 0x20 [0034.189] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J3ZkluwvkiGXI8r-B5.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98996a00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98996a00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98996a00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="J3ZkluwvkiGXI8r-B5.lnk", cAlternateFileName="J3ZKLU~1.LNK")) returned 0x5c8f80 [0034.189] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98996a00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98996a00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98996a00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="J3ZkluwvkiGXI8r-B5.lnk", cAlternateFileName="J3ZKLU~1.LNK")) returned 0 [0034.189] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.189] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J3ZkluwvkiGXI8r-B5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j3zkluwvkigxi8r-b5.lnk")) returned 1 [0034.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J3ZkluwvkiGXI8r-B5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j3zkluwvkigxi8r-b5.lnk")) returned 0xffffffff [0034.190] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989708a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x989708a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x989708a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa9e, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="jFlm5M5isN1V6QsQFljh.lnk", cAlternateFileName="JFLM5M~1.LNK")) returned 1 [0034.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jFlm5M5isN1V6QsQFljh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jflm5m5isn1v6qsqfljh.lnk")) returned 0x20 [0034.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jFlm5M5isN1V6QsQFljh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jflm5m5isn1v6qsqfljh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jFlm5M5isN1V6QsQFljh.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jflm5m5isn1v6qsqfljh.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.191] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa9e, lpOverlapped=0x0) returned 1 [0034.192] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa9e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa9e, lpOverlapped=0x0) returned 1 [0034.193] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.193] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.193] CloseHandle (hObject=0xfc) returned 1 [0034.193] CloseHandle (hObject=0x104) returned 1 [0034.193] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jFlm5M5isN1V6QsQFljh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jflm5m5isn1v6qsqfljh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jFlm5M5isN1V6QsQFljh.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jflm5m5isn1v6qsqfljh.lnk.crypt")) returned 0 [0034.194] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jFlm5M5isN1V6QsQFljh.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jflm5m5isn1v6qsqfljh.lnk.crypt")) returned 0x20 [0034.194] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jFlm5M5isN1V6QsQFljh.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989708a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x989708a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x989708a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa9e, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="jFlm5M5isN1V6QsQFljh.lnk", cAlternateFileName="JFLM5M~1.LNK")) returned 0x5c8f80 [0034.194] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989708a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x989708a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x989708a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa9e, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="jFlm5M5isN1V6QsQFljh.lnk", cAlternateFileName="JFLM5M~1.LNK")) returned 0 [0034.194] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.194] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jFlm5M5isN1V6QsQFljh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jflm5m5isn1v6qsqfljh.lnk")) returned 1 [0034.195] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jFlm5M5isN1V6QsQFljh.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jflm5m5isn1v6qsqfljh.lnk")) returned 0xffffffff [0034.195] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e36d00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96e36d00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96e36d00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1481, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="jqW0-oJ-hD7GVCfIZGQ.mkv.lnk", cAlternateFileName="JQW0-O~1.LNK")) returned 1 [0034.195] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqW0-oJ-hD7GVCfIZGQ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jqw0-oj-hd7gvcfizgq.mkv.lnk")) returned 0x20 [0034.195] VirtualAlloc (lpAddress=0x3140000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3140000 [0034.195] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqW0-oJ-hD7GVCfIZGQ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jqw0-oj-hd7gvcfizgq.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.195] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqW0-oJ-hD7GVCfIZGQ.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jqw0-oj-hd7gvcfizgq.mkv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.196] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.197] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.198] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x481, lpOverlapped=0x0) returned 1 [0034.198] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x481, lpOverlapped=0x0) returned 1 [0034.198] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.198] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.198] CloseHandle (hObject=0x104) returned 1 [0034.198] CloseHandle (hObject=0xfc) returned 1 [0034.199] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqW0-oJ-hD7GVCfIZGQ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jqw0-oj-hd7gvcfizgq.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqW0-oJ-hD7GVCfIZGQ.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jqw0-oj-hd7gvcfizgq.mkv.lnk.crypt")) returned 0 [0034.199] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqW0-oJ-hD7GVCfIZGQ.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jqw0-oj-hd7gvcfizgq.mkv.lnk.crypt")) returned 0x20 [0034.199] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqW0-oJ-hD7GVCfIZGQ.mkv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e36d00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96e36d00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96e36d00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1481, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="jqW0-oJ-hD7GVCfIZGQ.mkv.lnk", cAlternateFileName="JQW0-O~1.LNK")) returned 0x5c8f80 [0034.199] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e36d00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96e36d00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96e36d00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1481, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="jqW0-oJ-hD7GVCfIZGQ.mkv.lnk", cAlternateFileName="JQW0-O~1.LNK")) returned 0 [0034.199] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.200] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqW0-oJ-hD7GVCfIZGQ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jqw0-oj-hd7gvcfizgq.mkv.lnk")) returned 1 [0034.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jqW0-oJ-hD7GVCfIZGQ.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jqw0-oj-hd7gvcfizgq.mkv.lnk")) returned 0xffffffff [0034.200] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9717cb40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9717cb40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9717cb40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x0, dwReserved1=0x0, cFileName="jzvXZWBC2RYZP.lnk", cAlternateFileName="JZVXZW~1.LNK")) returned 1 [0034.201] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzvXZWBC2RYZP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jzvxzwbc2ryzp.lnk")) returned 0x20 [0034.201] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzvXZWBC2RYZP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jzvxzwbc2ryzp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.201] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzvXZWBC2RYZP.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jzvxzwbc2ryzp.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.201] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x252, lpOverlapped=0x0) returned 1 [0034.202] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x252, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x252, lpOverlapped=0x0) returned 1 [0034.203] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.203] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.203] CloseHandle (hObject=0xfc) returned 1 [0034.203] CloseHandle (hObject=0x104) returned 1 [0034.204] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzvXZWBC2RYZP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jzvxzwbc2ryzp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzvXZWBC2RYZP.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jzvxzwbc2ryzp.lnk.crypt")) returned 0 [0034.204] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzvXZWBC2RYZP.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jzvxzwbc2ryzp.lnk.crypt")) returned 0x20 [0034.204] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzvXZWBC2RYZP.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9717cb40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9717cb40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9717cb40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="jzvXZWBC2RYZP.lnk", cAlternateFileName="JZVXZW~1.LNK")) returned 0x5c8f80 [0034.205] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9717cb40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9717cb40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9717cb40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="jzvXZWBC2RYZP.lnk", cAlternateFileName="JZVXZW~1.LNK")) returned 0 [0034.205] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.205] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzvXZWBC2RYZP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jzvxzwbc2ryzp.lnk")) returned 1 [0034.206] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jzvXZWBC2RYZP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jzvxzwbc2ryzp.lnk")) returned 0xffffffff [0034.206] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x996881a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996881a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996881a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="kGd4Dp.flv.lnk", cAlternateFileName="KGD4DP~1.LNK")) returned 1 [0034.206] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kGd4Dp.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgd4dp.flv.lnk")) returned 0x20 [0034.206] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kGd4Dp.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgd4dp.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.206] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kGd4Dp.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgd4dp.flv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.207] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.207] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.208] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x3bf, lpOverlapped=0x0) returned 1 [0034.208] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x3bf, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x3bf, lpOverlapped=0x0) returned 1 [0034.208] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.208] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.208] CloseHandle (hObject=0x104) returned 1 [0034.209] CloseHandle (hObject=0xfc) returned 1 [0034.209] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kGd4Dp.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgd4dp.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kGd4Dp.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgd4dp.flv.lnk.crypt")) returned 0 [0034.210] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kGd4Dp.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgd4dp.flv.lnk.crypt")) returned 0x20 [0034.210] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kGd4Dp.flv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x996881a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996881a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996881a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13bf, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="kGd4Dp.flv.lnk", cAlternateFileName="KGD4DP~1.LNK")) returned 0x5c8f80 [0034.210] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x996881a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996881a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996881a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13bf, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="kGd4Dp.flv.lnk", cAlternateFileName="KGD4DP~1.LNK")) returned 0 [0034.210] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.210] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kGd4Dp.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgd4dp.flv.lnk")) returned 1 [0034.211] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kGd4Dp.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgd4dp.flv.lnk")) returned 0xffffffff [0034.211] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96c6dc80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96c6dc80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96c6dc80, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="L32hcyZtEpundH.lnk", cAlternateFileName="L32HCY~1.LNK")) returned 1 [0034.211] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L32hcyZtEpundH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l32hcyztepundh.lnk")) returned 0x20 [0034.211] VirtualAlloc (lpAddress=0x3144000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3144000 [0034.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L32hcyZtEpundH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l32hcyztepundh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L32hcyZtEpundH.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l32hcyztepundh.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.212] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x257, lpOverlapped=0x0) returned 1 [0034.213] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x257, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x257, lpOverlapped=0x0) returned 1 [0034.214] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.214] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.214] CloseHandle (hObject=0xfc) returned 1 [0034.214] CloseHandle (hObject=0x104) returned 1 [0034.215] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L32hcyZtEpundH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l32hcyztepundh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L32hcyZtEpundH.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l32hcyztepundh.lnk.crypt")) returned 0 [0034.215] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L32hcyZtEpundH.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l32hcyztepundh.lnk.crypt")) returned 0x20 [0034.215] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L32hcyZtEpundH.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96c6dc80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96c6dc80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96c6dc80, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="L32hcyZtEpundH.lnk", cAlternateFileName="L32HCY~1.LNK")) returned 0x5c8f80 [0034.215] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96c6dc80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96c6dc80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96c6dc80, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="L32hcyZtEpundH.lnk", cAlternateFileName="L32HCY~1.LNK")) returned 0 [0034.215] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.215] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L32hcyZtEpundH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l32hcyztepundh.lnk")) returned 1 [0034.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\L32hcyZtEpundH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\l32hcyztepundh.lnk")) returned 0xffffffff [0034.216] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9736bd20, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9736bd20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9736bd20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="lAQFBeUeHy.lnk", cAlternateFileName="LAQFBE~1.LNK")) returned 1 [0034.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lAQFBeUeHy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\laqfbeuehy.lnk")) returned 0x20 [0034.216] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lAQFBeUeHy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\laqfbeuehy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.216] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lAQFBeUeHy.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\laqfbeuehy.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.217] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x3f2, lpOverlapped=0x0) returned 1 [0034.218] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x3f2, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x3f2, lpOverlapped=0x0) returned 1 [0034.218] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.219] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.219] CloseHandle (hObject=0x104) returned 1 [0034.219] CloseHandle (hObject=0xfc) returned 1 [0034.220] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lAQFBeUeHy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\laqfbeuehy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lAQFBeUeHy.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\laqfbeuehy.lnk.crypt")) returned 0 [0034.220] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lAQFBeUeHy.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\laqfbeuehy.lnk.crypt")) returned 0x20 [0034.220] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lAQFBeUeHy.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9736bd20, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9736bd20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9736bd20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="lAQFBeUeHy.lnk", cAlternateFileName="LAQFBE~1.LNK")) returned 0x5c8f80 [0034.220] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9736bd20, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9736bd20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9736bd20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="lAQFBeUeHy.lnk", cAlternateFileName="LAQFBE~1.LNK")) returned 0 [0034.220] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.220] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lAQFBeUeHy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\laqfbeuehy.lnk")) returned 1 [0034.221] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lAQFBeUeHy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\laqfbeuehy.lnk")) returned 0xffffffff [0034.221] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f63fa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f63fa0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f63fa0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LcEzmMI.lnk", cAlternateFileName="")) returned 1 [0034.221] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LcEzmMI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lcezmmi.lnk")) returned 0x20 [0034.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LcEzmMI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lcezmmi.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LcEzmMI.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lcezmmi.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.222] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa16, lpOverlapped=0x0) returned 1 [0034.223] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa16, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa16, lpOverlapped=0x0) returned 1 [0034.224] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.224] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.224] CloseHandle (hObject=0xfc) returned 1 [0034.224] CloseHandle (hObject=0x104) returned 1 [0034.225] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LcEzmMI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lcezmmi.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LcEzmMI.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lcezmmi.lnk.crypt")) returned 0 [0034.225] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LcEzmMI.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lcezmmi.lnk.crypt")) returned 0x20 [0034.225] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LcEzmMI.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f63fa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f63fa0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f63fa0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="LcEzmMI.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.225] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f63fa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f63fa0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f63fa0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="LcEzmMI.lnk", cAlternateFileName="")) returned 0 [0034.225] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.225] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LcEzmMI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lcezmmi.lnk")) returned 1 [0034.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LcEzmMI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lcezmmi.lnk")) returned 0xffffffff [0034.226] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b5fa80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98b5fa80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98b5fa80, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x0, dwReserved1=0x0, cFileName="LmtSVhfzw.lnk", cAlternateFileName="LMTSVH~1.LNK")) returned 1 [0034.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmtSVhfzw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lmtsvhfzw.lnk")) returned 0x20 [0034.226] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmtSVhfzw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lmtsvhfzw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.226] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmtSVhfzw.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lmtsvhfzw.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.227] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa21, lpOverlapped=0x0) returned 1 [0034.228] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa21, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa21, lpOverlapped=0x0) returned 1 [0034.229] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.229] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.229] CloseHandle (hObject=0x104) returned 1 [0034.229] CloseHandle (hObject=0xfc) returned 1 [0034.229] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmtSVhfzw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lmtsvhfzw.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmtSVhfzw.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lmtsvhfzw.lnk.crypt")) returned 0 [0034.230] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmtSVhfzw.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lmtsvhfzw.lnk.crypt")) returned 0x20 [0034.230] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmtSVhfzw.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b5fa80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98b5fa80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98b5fa80, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="LmtSVhfzw.lnk", cAlternateFileName="LMTSVH~1.LNK")) returned 0x5c8f80 [0034.230] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b5fa80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98b5fa80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98b5fa80, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="LmtSVhfzw.lnk", cAlternateFileName="LMTSVH~1.LNK")) returned 0 [0034.230] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.230] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmtSVhfzw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lmtsvhfzw.lnk")) returned 1 [0034.231] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmtSVhfzw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lmtsvhfzw.lnk")) returned 0xffffffff [0034.231] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971a2ca0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x971a2ca0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x971a2ca0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="lovM7zTe54ZDP.lnk", cAlternateFileName="LOVM7Z~1.LNK")) returned 1 [0034.231] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lovM7zTe54ZDP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lovm7zte54zdp.lnk")) returned 0x20 [0034.231] VirtualAlloc (lpAddress=0x3148000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3148000 [0034.231] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lovM7zTe54ZDP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lovm7zte54zdp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.232] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lovM7zTe54ZDP.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lovm7zte54zdp.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.232] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa4d, lpOverlapped=0x0) returned 1 [0034.233] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa4d, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa4d, lpOverlapped=0x0) returned 1 [0034.234] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.234] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.234] CloseHandle (hObject=0xfc) returned 1 [0034.234] CloseHandle (hObject=0x104) returned 1 [0034.235] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lovM7zTe54ZDP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lovm7zte54zdp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lovM7zTe54ZDP.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lovm7zte54zdp.lnk.crypt")) returned 0 [0034.241] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lovM7zTe54ZDP.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lovm7zte54zdp.lnk.crypt")) returned 0x20 [0034.241] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lovM7zTe54ZDP.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971a2ca0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x971a2ca0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x971a2ca0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="lovM7zTe54ZDP.lnk", cAlternateFileName="LOVM7Z~1.LNK")) returned 0x5c8f80 [0034.241] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971a2ca0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x971a2ca0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x971a2ca0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="lovM7zTe54ZDP.lnk", cAlternateFileName="LOVM7Z~1.LNK")) returned 0 [0034.241] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.241] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lovM7zTe54ZDP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lovm7zte54zdp.lnk")) returned 1 [0034.242] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lovM7zTe54ZDP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\lovm7zte54zdp.lnk")) returned 0xffffffff [0034.242] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96a7eaa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996fa5c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996fa5c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe71, dwReserved0=0x0, dwReserved1=0x0, cFileName="LuoppkTQnaUtW.lnk", cAlternateFileName="LUOPPK~1.LNK")) returned 1 [0034.242] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LuoppkTQnaUtW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\luoppktqnautw.lnk")) returned 0x20 [0034.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LuoppkTQnaUtW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\luoppktqnautw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.242] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LuoppkTQnaUtW.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\luoppktqnautw.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.243] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xe71, lpOverlapped=0x0) returned 1 [0034.244] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xe71, lpOverlapped=0x0) returned 1 [0034.245] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.245] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.245] CloseHandle (hObject=0x104) returned 1 [0034.245] CloseHandle (hObject=0xfc) returned 1 [0034.245] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LuoppkTQnaUtW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\luoppktqnautw.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LuoppkTQnaUtW.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\luoppktqnautw.lnk.crypt")) returned 0 [0034.246] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LuoppkTQnaUtW.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\luoppktqnautw.lnk.crypt")) returned 0x20 [0034.246] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LuoppkTQnaUtW.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96a7eaa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996fa5c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996fa5c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe71, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="LuoppkTQnaUtW.lnk", cAlternateFileName="LUOPPK~1.LNK")) returned 0x5c8f80 [0034.246] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96a7eaa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996fa5c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996fa5c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe71, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="LuoppkTQnaUtW.lnk", cAlternateFileName="LUOPPK~1.LNK")) returned 0 [0034.246] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.246] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LuoppkTQnaUtW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\luoppktqnautw.lnk")) returned 1 [0034.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LuoppkTQnaUtW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\luoppktqnautw.lnk")) returned 0xffffffff [0034.247] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b89440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x991792e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x991792e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x98f, dwReserved0=0x0, dwReserved1=0x0, cFileName="m1LcNfC15e9dwL.lnk", cAlternateFileName="M1LCNF~1.LNK")) returned 1 [0034.247] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1LcNfC15e9dwL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1lcnfc15e9dwl.lnk")) returned 0x20 [0034.247] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1LcNfC15e9dwL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1lcnfc15e9dwl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.247] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1LcNfC15e9dwL.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1lcnfc15e9dwl.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.248] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x98f, lpOverlapped=0x0) returned 1 [0034.249] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x98f, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x98f, lpOverlapped=0x0) returned 1 [0034.250] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.250] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.250] CloseHandle (hObject=0xfc) returned 1 [0034.250] CloseHandle (hObject=0x104) returned 1 [0034.251] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1LcNfC15e9dwL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1lcnfc15e9dwl.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1LcNfC15e9dwL.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1lcnfc15e9dwl.lnk.crypt")) returned 0 [0034.251] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1LcNfC15e9dwL.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1lcnfc15e9dwl.lnk.crypt")) returned 0x20 [0034.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1LcNfC15e9dwL.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b89440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x991792e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x991792e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x98f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="m1LcNfC15e9dwL.lnk", cAlternateFileName="M1LCNF~1.LNK")) returned 0x5c8f80 [0034.251] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b89440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x991792e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x991792e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x98f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="m1LcNfC15e9dwL.lnk", cAlternateFileName="M1LCNF~1.LNK")) returned 0 [0034.251] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.252] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1LcNfC15e9dwL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1lcnfc15e9dwl.lnk")) returned 1 [0034.252] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1LcNfC15e9dwL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1lcnfc15e9dwl.lnk")) returned 0xffffffff [0034.253] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9995bbc0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9995bbc0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9995bbc0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="m1sLm.lnk", cAlternateFileName="")) returned 1 [0034.253] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1sLm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1slm.lnk")) returned 0x20 [0034.253] VirtualAlloc (lpAddress=0x314c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x314c000 [0034.253] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1sLm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1slm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.253] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1sLm.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1slm.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.254] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x226, lpOverlapped=0x0) returned 1 [0034.254] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x226, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x226, lpOverlapped=0x0) returned 1 [0034.255] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.255] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.255] CloseHandle (hObject=0x104) returned 1 [0034.255] CloseHandle (hObject=0xfc) returned 1 [0034.256] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1sLm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1slm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1sLm.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1slm.lnk.crypt")) returned 0 [0034.256] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1sLm.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1slm.lnk.crypt")) returned 0x20 [0034.256] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1sLm.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9995bbc0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9995bbc0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9995bbc0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="m1sLm.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.256] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9995bbc0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9995bbc0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9995bbc0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="m1sLm.lnk", cAlternateFileName="")) returned 0 [0034.256] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.256] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1sLm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1slm.lnk")) returned 1 [0034.257] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m1sLm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m1slm.lnk")) returned 0xffffffff [0034.257] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f17ce0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f17ce0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f17ce0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="McWc.lnk", cAlternateFileName="")) returned 1 [0034.257] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\McWc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mcwc.lnk")) returned 0x20 [0034.258] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\McWc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mcwc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.258] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\McWc.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mcwc.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.258] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x9d5, lpOverlapped=0x0) returned 1 [0034.259] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x9d5, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x9d5, lpOverlapped=0x0) returned 1 [0034.260] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.260] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.260] CloseHandle (hObject=0xfc) returned 1 [0034.260] CloseHandle (hObject=0x104) returned 1 [0034.261] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\McWc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mcwc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\McWc.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mcwc.lnk.crypt")) returned 0 [0034.261] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\McWc.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mcwc.lnk.crypt")) returned 0x20 [0034.261] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\McWc.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f17ce0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f17ce0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f17ce0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="McWc.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.261] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f17ce0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f17ce0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f17ce0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="McWc.lnk", cAlternateFileName="")) returned 0 [0034.261] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.261] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\McWc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mcwc.lnk")) returned 1 [0034.262] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\McWc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mcwc.lnk")) returned 0xffffffff [0034.262] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9787abe0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9787abe0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9787abe0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="moa2K41f.lnk", cAlternateFileName="")) returned 1 [0034.262] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\moa2K41f.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\moa2k41f.lnk")) returned 0x20 [0034.262] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\moa2K41f.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\moa2k41f.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.263] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\moa2K41f.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\moa2k41f.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.263] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x239, lpOverlapped=0x0) returned 1 [0034.264] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x239, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x239, lpOverlapped=0x0) returned 1 [0034.265] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.265] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.265] CloseHandle (hObject=0x104) returned 1 [0034.265] CloseHandle (hObject=0xfc) returned 1 [0034.268] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\moa2K41f.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\moa2k41f.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\moa2K41f.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\moa2k41f.lnk.crypt")) returned 0 [0034.268] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\moa2K41f.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\moa2k41f.lnk.crypt")) returned 0x20 [0034.268] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\moa2K41f.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9787abe0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9787abe0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9787abe0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="moa2K41f.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.268] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9787abe0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9787abe0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9787abe0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="moa2K41f.lnk", cAlternateFileName="")) returned 0 [0034.268] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.268] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\moa2K41f.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\moa2k41f.lnk")) returned 1 [0034.269] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\moa2K41f.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\moa2k41f.lnk")) returned 0xffffffff [0034.269] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97adc1e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99935a60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99935a60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MuwQtWu1bqcJz_nr_4.lnk", cAlternateFileName="MUWQTW~1.LNK")) returned 1 [0034.269] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MuwQtWu1bqcJz_nr_4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\muwqtwu1bqcjz_nr_4.lnk")) returned 0x20 [0034.269] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MuwQtWu1bqcJz_nr_4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\muwqtwu1bqcjz_nr_4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.269] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MuwQtWu1bqcJz_nr_4.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\muwqtwu1bqcjz_nr_4.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.270] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x29b, lpOverlapped=0x0) returned 1 [0034.271] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x29b, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x29b, lpOverlapped=0x0) returned 1 [0034.272] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.272] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.272] CloseHandle (hObject=0xfc) returned 1 [0034.272] CloseHandle (hObject=0x104) returned 1 [0034.272] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MuwQtWu1bqcJz_nr_4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\muwqtwu1bqcjz_nr_4.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MuwQtWu1bqcJz_nr_4.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\muwqtwu1bqcjz_nr_4.lnk.crypt")) returned 0 [0034.273] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MuwQtWu1bqcJz_nr_4.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\muwqtwu1bqcjz_nr_4.lnk.crypt")) returned 0x20 [0034.273] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MuwQtWu1bqcJz_nr_4.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97adc1e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99935a60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99935a60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="MuwQtWu1bqcJz_nr_4.lnk", cAlternateFileName="MUWQTW~1.LNK")) returned 0x5c8f80 [0034.273] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97adc1e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99935a60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99935a60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="MuwQtWu1bqcJz_nr_4.lnk", cAlternateFileName="MUWQTW~1.LNK")) returned 0 [0034.273] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.273] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MuwQtWu1bqcJz_nr_4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\muwqtwu1bqcjz_nr_4.lnk")) returned 1 [0034.274] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MuwQtWu1bqcJz_nr_4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\muwqtwu1bqcjz_nr_4.lnk")) returned 0xffffffff [0034.274] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b632e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99afeae0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99afeae0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 1 [0034.274] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk")) returned 0x20 [0034.274] VirtualAlloc (lpAddress=0x3150000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3150000 [0034.274] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.275] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.275] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x52a, lpOverlapped=0x0) returned 1 [0034.276] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x52a, lpOverlapped=0x0) returned 1 [0034.277] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.277] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.277] CloseHandle (hObject=0x104) returned 1 [0034.277] CloseHandle (hObject=0xfc) returned 1 [0034.277] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.crypt")) returned 0 [0034.278] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.crypt")) returned 0x20 [0034.278] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b632e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99afeae0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99afeae0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 0x5c8f80 [0034.278] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b632e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99afeae0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99afeae0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 0 [0034.278] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.278] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk")) returned 1 [0034.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk")) returned 0xffffffff [0034.279] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b89440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9906e940, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9906e940, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 1 [0034.279] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk")) returned 0x20 [0034.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.280] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x54f, lpOverlapped=0x0) returned 1 [0034.281] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x54f, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x54f, lpOverlapped=0x0) returned 1 [0034.281] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.281] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.282] CloseHandle (hObject=0xfc) returned 1 [0034.282] CloseHandle (hObject=0x104) returned 1 [0034.283] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk.crypt")) returned 0 [0034.283] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk.crypt")) returned 0x20 [0034.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b89440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9906e940, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9906e940, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 0x5c8f80 [0034.283] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b89440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9906e940, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9906e940, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 0 [0034.283] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.283] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk")) returned 1 [0034.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk")) returned 0xffffffff [0034.284] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97130880, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x997dee00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x997dee00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 1 [0034.284] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk")) returned 0x20 [0034.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.285] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x539, lpOverlapped=0x0) returned 1 [0034.286] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x539, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x539, lpOverlapped=0x0) returned 1 [0034.287] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.287] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.287] CloseHandle (hObject=0x104) returned 1 [0034.287] CloseHandle (hObject=0xfc) returned 1 [0034.288] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.crypt")) returned 0 [0034.288] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.crypt")) returned 0x20 [0034.288] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97130880, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x997dee00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x997dee00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 0x5c8f80 [0034.288] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97130880, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x997dee00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x997dee00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 0 [0034.288] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.288] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk")) returned 1 [0034.289] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk")) returned 0xffffffff [0034.289] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x996d4460, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996d4460, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996d4460, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="N0tyvu.lnk", cAlternateFileName="")) returned 1 [0034.289] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N0tyvu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n0tyvu.lnk")) returned 0x20 [0034.289] VirtualAlloc (lpAddress=0x3154000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3154000 [0034.289] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N0tyvu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n0tyvu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.290] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N0tyvu.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n0tyvu.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.290] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xf68, lpOverlapped=0x0) returned 1 [0034.291] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xf68, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xf68, lpOverlapped=0x0) returned 1 [0034.292] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.292] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.292] CloseHandle (hObject=0xfc) returned 1 [0034.292] CloseHandle (hObject=0x104) returned 1 [0034.293] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N0tyvu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n0tyvu.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N0tyvu.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n0tyvu.lnk.crypt")) returned 0 [0034.293] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N0tyvu.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n0tyvu.lnk.crypt")) returned 0x20 [0034.293] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N0tyvu.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x996d4460, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996d4460, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996d4460, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf68, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="N0tyvu.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.293] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x996d4460, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996d4460, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996d4460, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf68, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="N0tyvu.lnk", cAlternateFileName="")) returned 0 [0034.293] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.293] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N0tyvu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n0tyvu.lnk")) returned 1 [0034.294] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N0tyvu.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n0tyvu.lnk")) returned 0xffffffff [0034.294] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f3de40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f3de40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f3de40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x0, dwReserved1=0x0, cFileName="nI67Wp8LP7.lnk", cAlternateFileName="NI67WP~1.LNK")) returned 1 [0034.294] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nI67Wp8LP7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni67wp8lp7.lnk")) returned 0x20 [0034.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nI67Wp8LP7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni67wp8lp7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nI67Wp8LP7.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni67wp8lp7.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.295] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa30, lpOverlapped=0x0) returned 1 [0034.296] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa30, lpOverlapped=0x0) returned 1 [0034.297] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.297] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.297] CloseHandle (hObject=0x104) returned 1 [0034.297] CloseHandle (hObject=0xfc) returned 1 [0034.297] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nI67Wp8LP7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni67wp8lp7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nI67Wp8LP7.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni67wp8lp7.lnk.crypt")) returned 0 [0034.298] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nI67Wp8LP7.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni67wp8lp7.lnk.crypt")) returned 0x20 [0034.298] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nI67Wp8LP7.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f3de40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f3de40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f3de40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="nI67Wp8LP7.lnk", cAlternateFileName="NI67WP~1.LNK")) returned 0x5c8f80 [0034.298] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f3de40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f3de40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f3de40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="nI67Wp8LP7.lnk", cAlternateFileName="NI67WP~1.LNK")) returned 0 [0034.298] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.298] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nI67Wp8LP7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni67wp8lp7.lnk")) returned 1 [0034.299] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nI67Wp8LP7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni67wp8lp7.lnk")) returned 0xffffffff [0034.299] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99153180, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99153180, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99153180, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ni_8L4qj1FGdbSRxn.lnk", cAlternateFileName="NI_8L4~1.LNK")) returned 1 [0034.299] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ni_8L4qj1FGdbSRxn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni_8l4qj1fgdbsrxn.lnk")) returned 0x20 [0034.299] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ni_8L4qj1FGdbSRxn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni_8l4qj1fgdbsrxn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.299] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ni_8L4qj1FGdbSRxn.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni_8l4qj1fgdbsrxn.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.300] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x415, lpOverlapped=0x0) returned 1 [0034.300] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x415, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x415, lpOverlapped=0x0) returned 1 [0034.301] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.301] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.301] CloseHandle (hObject=0xfc) returned 1 [0034.301] CloseHandle (hObject=0x104) returned 1 [0034.302] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ni_8L4qj1FGdbSRxn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni_8l4qj1fgdbsrxn.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ni_8L4qj1FGdbSRxn.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni_8l4qj1fgdbsrxn.lnk.crypt")) returned 0 [0034.302] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ni_8L4qj1FGdbSRxn.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni_8l4qj1fgdbsrxn.lnk.crypt")) returned 0x20 [0034.302] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ni_8L4qj1FGdbSRxn.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99153180, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99153180, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99153180, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Ni_8L4qj1FGdbSRxn.lnk", cAlternateFileName="NI_8L4~1.LNK")) returned 0x5c8f80 [0034.302] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99153180, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99153180, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99153180, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Ni_8L4qj1FGdbSRxn.lnk", cAlternateFileName="NI_8L4~1.LNK")) returned 0 [0034.302] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.302] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ni_8L4qj1FGdbSRxn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni_8l4qj1fgdbsrxn.lnk")) returned 1 [0034.303] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ni_8L4qj1FGdbSRxn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ni_8l4qj1fgdbsrxn.lnk")) returned 0xffffffff [0034.303] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x988b21c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x988b21c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x988b21c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="nJaxoH3z6.lnk", cAlternateFileName="NJAXOH~1.LNK")) returned 1 [0034.303] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJaxoH3z6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\njaxoh3z6.lnk")) returned 0x20 [0034.303] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJaxoH3z6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\njaxoh3z6.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.303] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJaxoH3z6.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\njaxoh3z6.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.304] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa2c, lpOverlapped=0x0) returned 1 [0034.305] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa2c, lpOverlapped=0x0) returned 1 [0034.306] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.306] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.306] CloseHandle (hObject=0x104) returned 1 [0034.306] CloseHandle (hObject=0xfc) returned 1 [0034.306] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJaxoH3z6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\njaxoh3z6.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJaxoH3z6.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\njaxoh3z6.lnk.crypt")) returned 0 [0034.306] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJaxoH3z6.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\njaxoh3z6.lnk.crypt")) returned 0x20 [0034.306] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJaxoH3z6.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x988b21c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x988b21c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x988b21c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="nJaxoH3z6.lnk", cAlternateFileName="NJAXOH~1.LNK")) returned 0x5c8f80 [0034.306] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x988b21c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x988b21c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x988b21c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="nJaxoH3z6.lnk", cAlternateFileName="NJAXOH~1.LNK")) returned 0 [0034.306] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.306] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJaxoH3z6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\njaxoh3z6.lnk")) returned 1 [0034.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nJaxoH3z6.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\njaxoh3z6.lnk")) returned 0xffffffff [0034.307] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983a3300, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x983a3300, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x983a3300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x0, dwReserved1=0x0, cFileName="nL2dk-97jFEcTR.lnk", cAlternateFileName="NL2DK-~1.LNK")) returned 1 [0034.307] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nL2dk-97jFEcTR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nl2dk-97jfectr.lnk")) returned 0x20 [0034.307] VirtualAlloc (lpAddress=0x3158000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3158000 [0034.307] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nL2dk-97jFEcTR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nl2dk-97jfectr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.308] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nL2dk-97jFEcTR.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nl2dk-97jfectr.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.308] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa63, lpOverlapped=0x0) returned 1 [0034.309] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa63, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa63, lpOverlapped=0x0) returned 1 [0034.310] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.310] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.310] CloseHandle (hObject=0xfc) returned 1 [0034.310] CloseHandle (hObject=0x104) returned 1 [0034.310] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nL2dk-97jFEcTR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nl2dk-97jfectr.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nL2dk-97jFEcTR.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nl2dk-97jfectr.lnk.crypt")) returned 0 [0034.310] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nL2dk-97jFEcTR.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nl2dk-97jfectr.lnk.crypt")) returned 0x20 [0034.311] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nL2dk-97jFEcTR.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983a3300, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x983a3300, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x983a3300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="nL2dk-97jFEcTR.lnk", cAlternateFileName="NL2DK-~1.LNK")) returned 0x5c8f80 [0034.311] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983a3300, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x983a3300, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x983a3300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="nL2dk-97jFEcTR.lnk", cAlternateFileName="NL2DK-~1.LNK")) returned 0 [0034.311] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.311] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nL2dk-97jFEcTR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nl2dk-97jfectr.lnk")) returned 1 [0034.312] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nL2dk-97jFEcTR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nl2dk-97jfectr.lnk")) returned 0xffffffff [0034.312] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d524c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996ae300, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996ae300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x0, dwReserved1=0x0, cFileName="NmYHleAHvhFUD.lnk", cAlternateFileName="NMYHLE~1.LNK")) returned 1 [0034.312] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NmYHleAHvhFUD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nmyhleahvhfud.lnk")) returned 0x20 [0034.312] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NmYHleAHvhFUD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nmyhleahvhfud.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.312] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NmYHleAHvhFUD.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nmyhleahvhfud.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.313] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x997, lpOverlapped=0x0) returned 1 [0034.314] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x997, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x997, lpOverlapped=0x0) returned 1 [0034.314] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.315] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.315] CloseHandle (hObject=0x104) returned 1 [0034.315] CloseHandle (hObject=0xfc) returned 1 [0034.315] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NmYHleAHvhFUD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nmyhleahvhfud.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NmYHleAHvhFUD.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nmyhleahvhfud.lnk.crypt")) returned 0 [0034.315] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NmYHleAHvhFUD.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nmyhleahvhfud.lnk.crypt")) returned 0x20 [0034.315] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NmYHleAHvhFUD.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d524c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996ae300, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996ae300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="NmYHleAHvhFUD.lnk", cAlternateFileName="NMYHLE~1.LNK")) returned 0x5c8f80 [0034.315] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d524c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996ae300, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996ae300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="NmYHleAHvhFUD.lnk", cAlternateFileName="NMYHLE~1.LNK")) returned 0 [0034.315] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.315] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NmYHleAHvhFUD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nmyhleahvhfud.lnk")) returned 1 [0034.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NmYHleAHvhFUD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nmyhleahvhfud.lnk")) returned 0xffffffff [0034.316] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a66560, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99a66560, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99a66560, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa72, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPyBn4PYfD0Uer9-.lnk", cAlternateFileName="NPYBN4~1.LNK")) returned 1 [0034.316] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NPyBn4PYfD0Uer9-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\npybn4pyfd0uer9-.lnk")) returned 0x20 [0034.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NPyBn4PYfD0Uer9-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\npybn4pyfd0uer9-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.317] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NPyBn4PYfD0Uer9-.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\npybn4pyfd0uer9-.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.317] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa72, lpOverlapped=0x0) returned 1 [0034.318] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa72, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa72, lpOverlapped=0x0) returned 1 [0034.319] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.319] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.319] CloseHandle (hObject=0xfc) returned 1 [0034.319] CloseHandle (hObject=0x104) returned 1 [0034.319] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NPyBn4PYfD0Uer9-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\npybn4pyfd0uer9-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NPyBn4PYfD0Uer9-.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\npybn4pyfd0uer9-.lnk.crypt")) returned 0 [0034.319] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NPyBn4PYfD0Uer9-.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\npybn4pyfd0uer9-.lnk.crypt")) returned 0x20 [0034.319] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NPyBn4PYfD0Uer9-.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a66560, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99a66560, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99a66560, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa72, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="NPyBn4PYfD0Uer9-.lnk", cAlternateFileName="NPYBN4~1.LNK")) returned 0x5c8f80 [0034.319] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a66560, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99a66560, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99a66560, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa72, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="NPyBn4PYfD0Uer9-.lnk", cAlternateFileName="NPYBN4~1.LNK")) returned 0 [0034.319] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.320] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NPyBn4PYfD0Uer9-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\npybn4pyfd0uer9-.lnk")) returned 1 [0034.320] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NPyBn4PYfD0Uer9-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\npybn4pyfd0uer9-.lnk")) returned 0xffffffff [0034.320] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b5fa80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98b5fa80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98b5fa80, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="NvfRbKM-Q.flv.lnk", cAlternateFileName="NVFRBK~1.LNK")) returned 1 [0034.320] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvfRbKM-Q.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvfrbkm-q.flv.lnk")) returned 0x20 [0034.321] VirtualAlloc (lpAddress=0x315c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x315c000 [0034.321] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvfRbKM-Q.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvfrbkm-q.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.321] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvfRbKM-Q.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvfrbkm-q.flv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.322] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x9cd, lpOverlapped=0x0) returned 1 [0034.322] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x9cd, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x9cd, lpOverlapped=0x0) returned 1 [0034.323] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.323] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.323] CloseHandle (hObject=0x104) returned 1 [0034.324] CloseHandle (hObject=0xfc) returned 1 [0034.324] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvfRbKM-Q.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvfrbkm-q.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvfRbKM-Q.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvfrbkm-q.flv.lnk.crypt")) returned 0 [0034.324] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvfRbKM-Q.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvfrbkm-q.flv.lnk.crypt")) returned 0x20 [0034.324] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvfRbKM-Q.flv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b5fa80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98b5fa80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98b5fa80, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9cd, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="NvfRbKM-Q.flv.lnk", cAlternateFileName="NVFRBK~1.LNK")) returned 0x5c8f80 [0034.324] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b5fa80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98b5fa80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98b5fa80, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9cd, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="NvfRbKM-Q.flv.lnk", cAlternateFileName="NVFRBK~1.LNK")) returned 0 [0034.324] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.324] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvfRbKM-Q.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvfrbkm-q.flv.lnk")) returned 1 [0034.325] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NvfRbKM-Q.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvfrbkm-q.flv.lnk")) returned 0xffffffff [0034.325] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99afeae0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99afeae0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99afeae0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="nVlL.lnk", cAlternateFileName="")) returned 1 [0034.325] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nVlL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvll.lnk")) returned 0x20 [0034.325] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nVlL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvll.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.325] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nVlL.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvll.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.326] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x2d5, lpOverlapped=0x0) returned 1 [0034.327] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x2d5, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x2d5, lpOverlapped=0x0) returned 1 [0034.327] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.327] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.328] CloseHandle (hObject=0xfc) returned 1 [0034.328] CloseHandle (hObject=0x104) returned 1 [0034.328] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nVlL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvll.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nVlL.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvll.lnk.crypt")) returned 0 [0034.328] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nVlL.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvll.lnk.crypt")) returned 0x20 [0034.328] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nVlL.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99afeae0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99afeae0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99afeae0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="nVlL.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.328] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99afeae0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99afeae0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99afeae0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="nVlL.lnk", cAlternateFileName="")) returned 0 [0034.328] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.328] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nVlL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvll.lnk")) returned 1 [0034.329] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nVlL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nvll.lnk")) returned 0xffffffff [0034.329] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99662040, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99662040, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99662040, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x93b, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="O4Yqd.lnk", cAlternateFileName="")) returned 1 [0034.329] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O4Yqd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4yqd.lnk")) returned 0x20 [0034.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O4Yqd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4yqd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.330] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O4Yqd.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4yqd.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.330] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x93b, lpOverlapped=0x0) returned 1 [0034.331] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x93b, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x93b, lpOverlapped=0x0) returned 1 [0034.332] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.332] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.332] CloseHandle (hObject=0x104) returned 1 [0034.332] CloseHandle (hObject=0xfc) returned 1 [0034.332] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O4Yqd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4yqd.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O4Yqd.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4yqd.lnk.crypt")) returned 0 [0034.332] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O4Yqd.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4yqd.lnk.crypt")) returned 0x20 [0034.332] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O4Yqd.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99662040, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99662040, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99662040, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x93b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="O4Yqd.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.332] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99662040, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99662040, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99662040, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x93b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="O4Yqd.lnk", cAlternateFileName="")) returned 0 [0034.332] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.332] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O4Yqd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4yqd.lnk")) returned 1 [0034.333] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O4Yqd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o4yqd.lnk")) returned 0xffffffff [0034.333] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fb0260, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98fb0260, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98fb0260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="oE_MoJA.lnk", cAlternateFileName="")) returned 1 [0034.333] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oE_MoJA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oe_moja.lnk")) returned 0x20 [0034.333] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oE_MoJA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oe_moja.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.334] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oE_MoJA.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oe_moja.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.334] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x2e6, lpOverlapped=0x0) returned 1 [0034.335] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x2e6, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x2e6, lpOverlapped=0x0) returned 1 [0034.336] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.336] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.336] CloseHandle (hObject=0xfc) returned 1 [0034.336] CloseHandle (hObject=0x104) returned 1 [0034.336] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oE_MoJA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oe_moja.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oE_MoJA.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oe_moja.lnk.crypt")) returned 0 [0034.336] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oE_MoJA.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oe_moja.lnk.crypt")) returned 0x20 [0034.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oE_MoJA.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fb0260, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98fb0260, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98fb0260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2e6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="oE_MoJA.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.336] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98fb0260, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98fb0260, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98fb0260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2e6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="oE_MoJA.lnk", cAlternateFileName="")) returned 0 [0034.336] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.337] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oE_MoJA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oe_moja.lnk")) returned 1 [0034.337] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oE_MoJA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oe_moja.lnk")) returned 0xffffffff [0034.337] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e94440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97e94440, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97e94440, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnJy.lnk", cAlternateFileName="")) returned 1 [0034.337] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PnJy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pnjy.lnk")) returned 0x20 [0034.338] VirtualAlloc (lpAddress=0x3160000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3160000 [0034.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PnJy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pnjy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.338] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PnJy.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pnjy.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.339] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x9f1, lpOverlapped=0x0) returned 1 [0034.339] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x9f1, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x9f1, lpOverlapped=0x0) returned 1 [0034.340] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.340] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.340] CloseHandle (hObject=0x104) returned 1 [0034.340] CloseHandle (hObject=0xfc) returned 1 [0034.341] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PnJy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pnjy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PnJy.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pnjy.lnk.crypt")) returned 0 [0034.341] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PnJy.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pnjy.lnk.crypt")) returned 0x20 [0034.341] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PnJy.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e94440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97e94440, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97e94440, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="PnJy.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.341] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e94440, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97e94440, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97e94440, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="PnJy.lnk", cAlternateFileName="")) returned 0 [0034.341] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.341] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PnJy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pnjy.lnk")) returned 1 [0034.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PnJy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pnjy.lnk")) returned 0xffffffff [0034.342] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9912d020, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9912d020, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9912d020, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1414, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="PVcYf9.flv.lnk", cAlternateFileName="PVCYF9~1.LNK")) returned 1 [0034.342] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PVcYf9.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pvcyf9.flv.lnk")) returned 0x20 [0034.342] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PVcYf9.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pvcyf9.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.342] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PVcYf9.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pvcyf9.flv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.343] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.344] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.345] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x414, lpOverlapped=0x0) returned 1 [0034.345] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x414, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x414, lpOverlapped=0x0) returned 1 [0034.345] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.345] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.345] CloseHandle (hObject=0xfc) returned 1 [0034.345] CloseHandle (hObject=0x104) returned 1 [0034.345] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PVcYf9.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pvcyf9.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PVcYf9.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pvcyf9.flv.lnk.crypt")) returned 0 [0034.345] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PVcYf9.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pvcyf9.flv.lnk.crypt")) returned 0x20 [0034.345] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PVcYf9.flv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9912d020, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9912d020, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9912d020, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1414, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="PVcYf9.flv.lnk", cAlternateFileName="PVCYF9~1.LNK")) returned 0x5c8f80 [0034.346] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9912d020, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9912d020, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9912d020, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1414, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="PVcYf9.flv.lnk", cAlternateFileName="PVCYF9~1.LNK")) returned 0 [0034.346] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.346] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PVcYf9.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pvcyf9.flv.lnk")) returned 1 [0034.346] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PVcYf9.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pvcyf9.flv.lnk")) returned 0xffffffff [0034.347] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f63fa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f63fa0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f63fa0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa73, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qc87LZYu5MnLTcCw5Q.lnk", cAlternateFileName="QC87LZ~1.LNK")) returned 1 [0034.347] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qc87LZYu5MnLTcCw5Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qc87lzyu5mnltccw5q.lnk")) returned 0x20 [0034.347] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qc87LZYu5MnLTcCw5Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qc87lzyu5mnltccw5q.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.347] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qc87LZYu5MnLTcCw5Q.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qc87lzyu5mnltccw5q.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.347] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa73, lpOverlapped=0x0) returned 1 [0034.348] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa73, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa73, lpOverlapped=0x0) returned 1 [0034.349] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.349] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.349] CloseHandle (hObject=0x104) returned 1 [0034.349] CloseHandle (hObject=0xfc) returned 1 [0034.349] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qc87LZYu5MnLTcCw5Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qc87lzyu5mnltccw5q.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qc87LZYu5MnLTcCw5Q.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qc87lzyu5mnltccw5q.lnk.crypt")) returned 0 [0034.350] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qc87LZYu5MnLTcCw5Q.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qc87lzyu5mnltccw5q.lnk.crypt")) returned 0x20 [0034.350] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qc87LZYu5MnLTcCw5Q.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f63fa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f63fa0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f63fa0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa73, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Qc87LZYu5MnLTcCw5Q.lnk", cAlternateFileName="QC87LZ~1.LNK")) returned 0x5c8f80 [0034.350] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98f63fa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98f63fa0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98f63fa0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa73, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Qc87LZYu5MnLTcCw5Q.lnk", cAlternateFileName="QC87LZ~1.LNK")) returned 0 [0034.350] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.350] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qc87LZYu5MnLTcCw5Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qc87lzyu5mnltccw5q.lnk")) returned 1 [0034.351] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Qc87LZYu5MnLTcCw5Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qc87lzyu5mnltccw5q.lnk")) returned 0xffffffff [0034.351] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99106ec0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99106ec0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99106ec0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf85, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="QFEDUHr5Z.lnk", cAlternateFileName="QFEDUH~1.LNK")) returned 1 [0034.351] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QFEDUHr5Z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qfeduhr5z.lnk")) returned 0x20 [0034.351] VirtualAlloc (lpAddress=0x3164000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3164000 [0034.351] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QFEDUHr5Z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qfeduhr5z.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.351] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QFEDUHr5Z.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qfeduhr5z.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.352] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xf85, lpOverlapped=0x0) returned 1 [0034.353] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xf85, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xf85, lpOverlapped=0x0) returned 1 [0034.353] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.354] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.354] CloseHandle (hObject=0xfc) returned 1 [0034.354] CloseHandle (hObject=0x104) returned 1 [0034.354] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QFEDUHr5Z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qfeduhr5z.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QFEDUHr5Z.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qfeduhr5z.lnk.crypt")) returned 0 [0034.354] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QFEDUHr5Z.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qfeduhr5z.lnk.crypt")) returned 0x20 [0034.354] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QFEDUHr5Z.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99106ec0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99106ec0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99106ec0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf85, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="QFEDUHr5Z.lnk", cAlternateFileName="QFEDUH~1.LNK")) returned 0x5c8f80 [0034.354] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99106ec0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99106ec0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99106ec0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf85, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="QFEDUHr5Z.lnk", cAlternateFileName="QFEDUH~1.LNK")) returned 0 [0034.354] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.354] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QFEDUHr5Z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qfeduhr5z.lnk")) returned 1 [0034.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QFEDUHr5Z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qfeduhr5z.lnk")) returned 0xffffffff [0034.355] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987a7820, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x987a7820, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x987a7820, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x992, dwReserved0=0x0, dwReserved1=0x0, cFileName="QvXt.mkv.lnk", cAlternateFileName="QVXTMK~1.LNK")) returned 1 [0034.355] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QvXt.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qvxt.mkv.lnk")) returned 0x20 [0034.355] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QvXt.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qvxt.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.356] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QvXt.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qvxt.mkv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.356] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x992, lpOverlapped=0x0) returned 1 [0034.357] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x992, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x992, lpOverlapped=0x0) returned 1 [0034.358] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.358] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.358] CloseHandle (hObject=0x104) returned 1 [0034.358] CloseHandle (hObject=0xfc) returned 1 [0034.358] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QvXt.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qvxt.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QvXt.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qvxt.mkv.lnk.crypt")) returned 0 [0034.358] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QvXt.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qvxt.mkv.lnk.crypt")) returned 0x20 [0034.358] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QvXt.mkv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987a7820, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x987a7820, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x987a7820, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x992, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="QvXt.mkv.lnk", cAlternateFileName="QVXTMK~1.LNK")) returned 0x5c8f80 [0034.359] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987a7820, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x987a7820, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x987a7820, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x992, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="QvXt.mkv.lnk", cAlternateFileName="QVXTMK~1.LNK")) returned 0 [0034.359] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.359] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QvXt.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qvxt.mkv.lnk")) returned 1 [0034.359] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QvXt.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qvxt.mkv.lnk")) returned 0xffffffff [0034.360] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e36d00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96e36d00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96e36d00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x0, dwReserved1=0x0, cFileName="QWKwKdI.lnk", cAlternateFileName="")) returned 1 [0034.360] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QWKwKdI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qwkwkdi.lnk")) returned 0x20 [0034.360] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QWKwKdI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qwkwkdi.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.360] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QWKwKdI.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qwkwkdi.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.361] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa07, lpOverlapped=0x0) returned 1 [0034.362] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa07, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa07, lpOverlapped=0x0) returned 1 [0034.363] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.363] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.363] CloseHandle (hObject=0xfc) returned 1 [0034.363] CloseHandle (hObject=0x104) returned 1 [0034.363] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QWKwKdI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qwkwkdi.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QWKwKdI.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qwkwkdi.lnk.crypt")) returned 0 [0034.363] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QWKwKdI.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qwkwkdi.lnk.crypt")) returned 0x20 [0034.363] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QWKwKdI.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e36d00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96e36d00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96e36d00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="QWKwKdI.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.363] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e36d00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96e36d00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96e36d00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="QWKwKdI.lnk", cAlternateFileName="")) returned 0 [0034.363] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.363] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QWKwKdI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qwkwkdi.lnk")) returned 1 [0034.364] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QWKwKdI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qwkwkdi.lnk")) returned 0xffffffff [0034.364] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986e9140, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x986e9140, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x986e9140, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa64, dwReserved0=0x0, dwReserved1=0x0, cFileName="rfTi4jYQDV0uM8w0K.lnk", cAlternateFileName="RFTI4J~1.LNK")) returned 1 [0034.364] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rfTi4jYQDV0uM8w0K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rfti4jyqdv0um8w0k.lnk")) returned 0x20 [0034.364] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rfTi4jYQDV0uM8w0K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rfti4jyqdv0um8w0k.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.365] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rfTi4jYQDV0uM8w0K.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rfti4jyqdv0um8w0k.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.365] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa64, lpOverlapped=0x0) returned 1 [0034.366] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa64, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa64, lpOverlapped=0x0) returned 1 [0034.367] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.367] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.367] CloseHandle (hObject=0x104) returned 1 [0034.367] CloseHandle (hObject=0xfc) returned 1 [0034.367] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rfTi4jYQDV0uM8w0K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rfti4jyqdv0um8w0k.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rfTi4jYQDV0uM8w0K.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rfti4jyqdv0um8w0k.lnk.crypt")) returned 0 [0034.367] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rfTi4jYQDV0uM8w0K.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rfti4jyqdv0um8w0k.lnk.crypt")) returned 0x20 [0034.367] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rfTi4jYQDV0uM8w0K.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986e9140, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x986e9140, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x986e9140, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa64, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="rfTi4jYQDV0uM8w0K.lnk", cAlternateFileName="RFTI4J~1.LNK")) returned 0x5c8f80 [0034.367] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986e9140, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x986e9140, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x986e9140, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa64, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="rfTi4jYQDV0uM8w0K.lnk", cAlternateFileName="RFTI4J~1.LNK")) returned 0 [0034.367] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.368] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rfTi4jYQDV0uM8w0K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rfti4jyqdv0um8w0k.lnk")) returned 1 [0034.368] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rfTi4jYQDV0uM8w0K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rfti4jyqdv0um8w0k.lnk")) returned 0xffffffff [0034.368] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991792e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x991792e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x991792e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="rgIcyANdL2Redj9.flv.lnk", cAlternateFileName="RGICYA~1.LNK")) returned 1 [0034.368] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rgIcyANdL2Redj9.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rgicyandl2redj9.flv.lnk")) returned 0x20 [0034.369] VirtualAlloc (lpAddress=0x3168000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3168000 [0034.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rgIcyANdL2Redj9.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rgicyandl2redj9.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rgIcyANdL2Redj9.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rgicyandl2redj9.flv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.370] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa0f, lpOverlapped=0x0) returned 1 [0034.370] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa0f, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa0f, lpOverlapped=0x0) returned 1 [0034.371] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.371] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.371] CloseHandle (hObject=0xfc) returned 1 [0034.371] CloseHandle (hObject=0x104) returned 1 [0034.371] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rgIcyANdL2Redj9.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rgicyandl2redj9.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rgIcyANdL2Redj9.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rgicyandl2redj9.flv.lnk.crypt")) returned 0 [0034.372] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rgIcyANdL2Redj9.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rgicyandl2redj9.flv.lnk.crypt")) returned 0x20 [0034.372] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rgIcyANdL2Redj9.flv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991792e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x991792e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x991792e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="rgIcyANdL2Redj9.flv.lnk", cAlternateFileName="RGICYA~1.LNK")) returned 0x5c8f80 [0034.372] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991792e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x991792e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x991792e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="rgIcyANdL2Redj9.flv.lnk", cAlternateFileName="RGICYA~1.LNK")) returned 0 [0034.372] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.372] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rgIcyANdL2Redj9.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rgicyandl2redj9.flv.lnk")) returned 1 [0034.373] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rgIcyANdL2Redj9.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rgicyandl2redj9.flv.lnk")) returned 0xffffffff [0034.373] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x999f4140, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x999f4140, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99a1a2a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="RJTkAx3XvY.lnk", cAlternateFileName="RJTKAX~1.LNK")) returned 1 [0034.373] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RJTkAx3XvY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rjtkax3xvy.lnk")) returned 0x20 [0034.373] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RJTkAx3XvY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rjtkax3xvy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.373] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RJTkAx3XvY.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rjtkax3xvy.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.374] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa30, lpOverlapped=0x0) returned 1 [0034.374] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa30, lpOverlapped=0x0) returned 1 [0034.376] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.376] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.376] CloseHandle (hObject=0x104) returned 1 [0034.376] CloseHandle (hObject=0xfc) returned 1 [0034.376] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RJTkAx3XvY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rjtkax3xvy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RJTkAx3XvY.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rjtkax3xvy.lnk.crypt")) returned 0 [0034.376] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RJTkAx3XvY.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rjtkax3xvy.lnk.crypt")) returned 0x20 [0034.376] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RJTkAx3XvY.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x999f4140, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x999f4140, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99a1a2a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="RJTkAx3XvY.lnk", cAlternateFileName="RJTKAX~1.LNK")) returned 0x5c8f80 [0034.376] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x999f4140, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x999f4140, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99a1a2a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="RJTkAx3XvY.lnk", cAlternateFileName="RJTKAX~1.LNK")) returned 0 [0034.376] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.376] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RJTkAx3XvY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rjtkax3xvy.lnk")) returned 1 [0034.377] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RJTkAx3XvY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rjtkax3xvy.lnk")) returned 0xffffffff [0034.377] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9989d4e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9989d4e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9989d4e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMAlosi.lnk", cAlternateFileName="")) returned 1 [0034.377] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMAlosi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmalosi.lnk")) returned 0x20 [0034.378] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMAlosi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmalosi.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.378] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMAlosi.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmalosi.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.378] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x3e1, lpOverlapped=0x0) returned 1 [0034.379] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x3e1, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x3e1, lpOverlapped=0x0) returned 1 [0034.380] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.380] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.380] CloseHandle (hObject=0xfc) returned 1 [0034.380] CloseHandle (hObject=0x104) returned 1 [0034.380] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMAlosi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmalosi.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMAlosi.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmalosi.lnk.crypt")) returned 0 [0034.380] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMAlosi.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmalosi.lnk.crypt")) returned 0x20 [0034.380] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMAlosi.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9989d4e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9989d4e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9989d4e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="RMAlosi.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.380] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9989d4e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9989d4e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9989d4e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="RMAlosi.lnk", cAlternateFileName="")) returned 0 [0034.380] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.381] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMAlosi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmalosi.lnk")) returned 1 [0034.381] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RMAlosi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmalosi.lnk")) returned 0xffffffff [0034.381] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971569e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99afeae0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99afeae0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming.lnk", cAlternateFileName="")) returned 1 [0034.381] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk")) returned 0x20 [0034.382] VirtualAlloc (lpAddress=0x316c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x316c000 [0034.382] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.382] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.383] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x303, lpOverlapped=0x0) returned 1 [0034.383] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x303, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x303, lpOverlapped=0x0) returned 1 [0034.384] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.384] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.384] CloseHandle (hObject=0x104) returned 1 [0034.384] CloseHandle (hObject=0xfc) returned 1 [0034.384] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.crypt")) returned 0 [0034.385] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.crypt")) returned 0x20 [0034.385] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971569e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99afeae0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99afeae0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Roaming.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.385] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971569e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99afeae0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99afeae0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Roaming.lnk", cAlternateFileName="")) returned 0 [0034.385] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.385] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk")) returned 1 [0034.386] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk")) returned 0xffffffff [0034.386] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9870f2a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9870f2a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9870f2a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x0, cFileName="RrY6.mkv.lnk", cAlternateFileName="RRY6MK~1.LNK")) returned 1 [0034.386] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrY6.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rry6.mkv.lnk")) returned 0x20 [0034.386] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrY6.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rry6.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.386] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrY6.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rry6.mkv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.387] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xe88, lpOverlapped=0x0) returned 1 [0034.387] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xe88, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xe88, lpOverlapped=0x0) returned 1 [0034.388] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.388] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.388] CloseHandle (hObject=0xfc) returned 1 [0034.388] CloseHandle (hObject=0x104) returned 1 [0034.389] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrY6.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rry6.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrY6.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rry6.mkv.lnk.crypt")) returned 0 [0034.389] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrY6.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rry6.mkv.lnk.crypt")) returned 0x20 [0034.389] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrY6.mkv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9870f2a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9870f2a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9870f2a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="RrY6.mkv.lnk", cAlternateFileName="RRY6MK~1.LNK")) returned 0x5c8f80 [0034.389] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9870f2a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9870f2a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9870f2a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="RrY6.mkv.lnk", cAlternateFileName="RRY6MK~1.LNK")) returned 0 [0034.389] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.389] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrY6.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rry6.mkv.lnk")) returned 1 [0034.390] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RrY6.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rry6.mkv.lnk")) returned 0xffffffff [0034.390] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976fde20, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x976fde20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x976fde20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x0, dwReserved1=0x0, cFileName="RsbC_5Xwws.lnk", cAlternateFileName="RSBC_5~1.LNK")) returned 1 [0034.390] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RsbC_5Xwws.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rsbc_5xwws.lnk")) returned 0x20 [0034.390] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RsbC_5Xwws.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rsbc_5xwws.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.390] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RsbC_5Xwws.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rsbc_5xwws.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.391] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa37, lpOverlapped=0x0) returned 1 [0034.392] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa37, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa37, lpOverlapped=0x0) returned 1 [0034.393] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.393] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.393] CloseHandle (hObject=0x104) returned 1 [0034.393] CloseHandle (hObject=0xfc) returned 1 [0034.393] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RsbC_5Xwws.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rsbc_5xwws.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RsbC_5Xwws.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rsbc_5xwws.lnk.crypt")) returned 0 [0034.393] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RsbC_5Xwws.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rsbc_5xwws.lnk.crypt")) returned 0x20 [0034.393] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RsbC_5Xwws.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976fde20, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x976fde20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x976fde20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="RsbC_5Xwws.lnk", cAlternateFileName="RSBC_5~1.LNK")) returned 0x5c8f80 [0034.394] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976fde20, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x976fde20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x976fde20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="RsbC_5Xwws.lnk", cAlternateFileName="RSBC_5~1.LNK")) returned 0 [0034.394] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.394] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RsbC_5Xwws.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rsbc_5xwws.lnk")) returned 1 [0034.394] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RsbC_5Xwws.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rsbc_5xwws.lnk")) returned 0xffffffff [0034.395] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d28b00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98d28b00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98d28b00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTNc lp7dm74RUn.lnk", cAlternateFileName="RTNCLP~1.LNK")) returned 1 [0034.395] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTNc lp7dm74RUn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtnc lp7dm74run.lnk")) returned 0x20 [0034.395] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTNc lp7dm74RUn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtnc lp7dm74run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.395] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTNc lp7dm74RUn.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtnc lp7dm74run.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.395] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa63, lpOverlapped=0x0) returned 1 [0034.396] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa63, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa63, lpOverlapped=0x0) returned 1 [0034.397] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.397] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.397] CloseHandle (hObject=0xfc) returned 1 [0034.397] CloseHandle (hObject=0x104) returned 1 [0034.398] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTNc lp7dm74RUn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtnc lp7dm74run.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTNc lp7dm74RUn.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtnc lp7dm74run.lnk.crypt")) returned 0 [0034.398] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTNc lp7dm74RUn.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtnc lp7dm74run.lnk.crypt")) returned 0x20 [0034.398] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTNc lp7dm74RUn.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d28b00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98d28b00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98d28b00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="RTNc lp7dm74RUn.lnk", cAlternateFileName="RTNCLP~1.LNK")) returned 0x5c8f80 [0034.398] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d28b00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98d28b00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98d28b00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="RTNc lp7dm74RUn.lnk", cAlternateFileName="RTNCLP~1.LNK")) returned 0 [0034.398] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.398] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTNc lp7dm74RUn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtnc lp7dm74run.lnk")) returned 1 [0034.399] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RTNc lp7dm74RUn.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rtnc lp7dm74run.lnk")) returned 0xffffffff [0034.399] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99935a60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99935a60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99935a60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="rv__7l.lnk", cAlternateFileName="")) returned 1 [0034.399] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rv__7l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv__7l.lnk")) returned 0x20 [0034.399] VirtualAlloc (lpAddress=0x3170000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3170000 [0034.399] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rv__7l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv__7l.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.400] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rv__7l.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv__7l.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.400] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x3aa, lpOverlapped=0x0) returned 1 [0034.401] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x3aa, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x3aa, lpOverlapped=0x0) returned 1 [0034.402] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.402] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.402] CloseHandle (hObject=0x104) returned 1 [0034.402] CloseHandle (hObject=0xfc) returned 1 [0034.402] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rv__7l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv__7l.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rv__7l.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv__7l.lnk.crypt")) returned 0 [0034.402] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rv__7l.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv__7l.lnk.crypt")) returned 0x20 [0034.402] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rv__7l.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99935a60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99935a60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99935a60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3aa, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="rv__7l.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.402] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99935a60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99935a60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99935a60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3aa, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="rv__7l.lnk", cAlternateFileName="")) returned 0 [0034.402] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.402] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rv__7l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv__7l.lnk")) returned 1 [0034.403] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rv__7l.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv__7l.lnk")) returned 0xffffffff [0034.403] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e6e2e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97e6e2e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97e6e2e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="snpq5514f5VxwNHMTa.lnk", cAlternateFileName="SNPQ55~1.LNK")) returned 1 [0034.403] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\snpq5514f5VxwNHMTa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snpq5514f5vxwnhmta.lnk")) returned 0x20 [0034.404] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\snpq5514f5VxwNHMTa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snpq5514f5vxwnhmta.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.404] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\snpq5514f5VxwNHMTa.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snpq5514f5vxwnhmta.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.404] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x3e8, lpOverlapped=0x0) returned 1 [0034.405] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x3e8, lpOverlapped=0x0) returned 1 [0034.406] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.406] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.406] CloseHandle (hObject=0xfc) returned 1 [0034.406] CloseHandle (hObject=0x104) returned 1 [0034.406] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\snpq5514f5VxwNHMTa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snpq5514f5vxwnhmta.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\snpq5514f5VxwNHMTa.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snpq5514f5vxwnhmta.lnk.crypt")) returned 0 [0034.406] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\snpq5514f5VxwNHMTa.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snpq5514f5vxwnhmta.lnk.crypt")) returned 0x20 [0034.406] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\snpq5514f5VxwNHMTa.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e6e2e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97e6e2e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97e6e2e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="snpq5514f5VxwNHMTa.lnk", cAlternateFileName="SNPQ55~1.LNK")) returned 0x5c8f80 [0034.407] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e6e2e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97e6e2e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97e6e2e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="snpq5514f5VxwNHMTa.lnk", cAlternateFileName="SNPQ55~1.LNK")) returned 0 [0034.407] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.407] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\snpq5514f5VxwNHMTa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snpq5514f5vxwnhmta.lnk")) returned 1 [0034.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\snpq5514f5VxwNHMTa.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\snpq5514f5vxwnhmta.lnk")) returned 0xffffffff [0034.408] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99851220, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99851220, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99851220, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="svF1qlhEpB-.ots.lnk", cAlternateFileName="SVF1QL~1.LNK")) returned 1 [0034.408] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\svF1qlhEpB-.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svf1qlhepb-.ots.lnk")) returned 0x20 [0034.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\svF1qlhEpB-.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svf1qlhepb-.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\svF1qlhEpB-.ots.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svf1qlhepb-.ots.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.409] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa16, lpOverlapped=0x0) returned 1 [0034.409] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa16, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa16, lpOverlapped=0x0) returned 1 [0034.410] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.410] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.410] CloseHandle (hObject=0x104) returned 1 [0034.410] CloseHandle (hObject=0xfc) returned 1 [0034.410] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\svF1qlhEpB-.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svf1qlhepb-.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\svF1qlhEpB-.ots.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svf1qlhepb-.ots.lnk.crypt")) returned 0 [0034.411] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\svF1qlhEpB-.ots.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svf1qlhepb-.ots.lnk.crypt")) returned 0x20 [0034.411] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\svF1qlhEpB-.ots.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99851220, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99851220, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99851220, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="svF1qlhEpB-.ots.lnk", cAlternateFileName="SVF1QL~1.LNK")) returned 0x5c8f80 [0034.411] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99851220, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99851220, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99851220, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="svF1qlhEpB-.ots.lnk", cAlternateFileName="SVF1QL~1.LNK")) returned 0 [0034.411] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.411] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\svF1qlhEpB-.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svf1qlhepb-.ots.lnk")) returned 1 [0034.412] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\svF1qlhEpB-.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\svf1qlhepb-.ots.lnk")) returned 0xffffffff [0034.412] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9811bba0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9811bba0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9811bba0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYrO3Uqr5m.lnk", cAlternateFileName="SYRO3U~1.LNK")) returned 1 [0034.412] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SYrO3Uqr5m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\syro3uqr5m.lnk")) returned 0x20 [0034.412] VirtualAlloc (lpAddress=0x3174000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3174000 [0034.412] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SYrO3Uqr5m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\syro3uqr5m.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.413] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SYrO3Uqr5m.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\syro3uqr5m.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.413] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x243, lpOverlapped=0x0) returned 1 [0034.414] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x243, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x243, lpOverlapped=0x0) returned 1 [0034.415] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.415] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.415] CloseHandle (hObject=0xfc) returned 1 [0034.415] CloseHandle (hObject=0x104) returned 1 [0034.415] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SYrO3Uqr5m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\syro3uqr5m.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SYrO3Uqr5m.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\syro3uqr5m.lnk.crypt")) returned 0 [0034.415] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SYrO3Uqr5m.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\syro3uqr5m.lnk.crypt")) returned 0x20 [0034.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SYrO3Uqr5m.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9811bba0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9811bba0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9811bba0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="SYrO3Uqr5m.lnk", cAlternateFileName="SYRO3U~1.LNK")) returned 0x5c8f80 [0034.415] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9811bba0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9811bba0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9811bba0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="SYrO3Uqr5m.lnk", cAlternateFileName="SYRO3U~1.LNK")) returned 0 [0034.415] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.415] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SYrO3Uqr5m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\syro3uqr5m.lnk")) returned 1 [0034.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SYrO3Uqr5m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\syro3uqr5m.lnk")) returned 0xffffffff [0034.416] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x995576a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x995576a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x995576a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="t6Ybl35E-1WGC.mkv.lnk", cAlternateFileName="T6YBL3~1.LNK")) returned 1 [0034.416] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t6Ybl35E-1WGC.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t6ybl35e-1wgc.mkv.lnk")) returned 0x20 [0034.416] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t6Ybl35E-1WGC.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t6ybl35e-1wgc.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.417] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t6Ybl35E-1WGC.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t6ybl35e-1wgc.mkv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.417] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xe5f, lpOverlapped=0x0) returned 1 [0034.418] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xe5f, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xe5f, lpOverlapped=0x0) returned 1 [0034.419] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.419] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.419] CloseHandle (hObject=0x104) returned 1 [0034.419] CloseHandle (hObject=0xfc) returned 1 [0034.419] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t6Ybl35E-1WGC.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t6ybl35e-1wgc.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t6Ybl35E-1WGC.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t6ybl35e-1wgc.mkv.lnk.crypt")) returned 0 [0034.419] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t6Ybl35E-1WGC.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t6ybl35e-1wgc.mkv.lnk.crypt")) returned 0x20 [0034.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t6Ybl35E-1WGC.mkv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x995576a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x995576a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x995576a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe5f, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="t6Ybl35E-1WGC.mkv.lnk", cAlternateFileName="T6YBL3~1.LNK")) returned 0x5c8f80 [0034.419] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x995576a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x995576a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x995576a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe5f, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="t6Ybl35E-1WGC.mkv.lnk", cAlternateFileName="T6YBL3~1.LNK")) returned 0 [0034.419] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.420] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t6Ybl35E-1WGC.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t6ybl35e-1wgc.mkv.lnk")) returned 1 [0034.420] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\t6Ybl35E-1WGC.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\t6ybl35e-1wgc.mkv.lnk")) returned 0xffffffff [0034.420] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a40400, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99a40400, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99a40400, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf68, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="tlYEuU.lnk", cAlternateFileName="")) returned 1 [0034.420] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlYEuU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tlyeuu.lnk")) returned 0x20 [0034.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlYEuU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tlyeuu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlYEuU.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tlyeuu.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.421] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xf68, lpOverlapped=0x0) returned 1 [0034.422] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xf68, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xf68, lpOverlapped=0x0) returned 1 [0034.423] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.423] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.423] CloseHandle (hObject=0xfc) returned 1 [0034.423] CloseHandle (hObject=0x104) returned 1 [0034.423] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlYEuU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tlyeuu.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlYEuU.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tlyeuu.lnk.crypt")) returned 0 [0034.424] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlYEuU.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tlyeuu.lnk.crypt")) returned 0x20 [0034.424] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlYEuU.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a40400, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99a40400, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99a40400, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf68, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="tlYEuU.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.424] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a40400, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x99a40400, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x99a40400, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf68, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="tlYEuU.lnk", cAlternateFileName="")) returned 0 [0034.424] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.424] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlYEuU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tlyeuu.lnk")) returned 1 [0034.425] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tlYEuU.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tlyeuu.lnk")) returned 0xffffffff [0034.425] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98083620, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98083620, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98083620, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf85, dwReserved0=0x0, dwReserved1=0x0, cFileName="tMuxzgPEV.lnk", cAlternateFileName="TMUXZG~1.LNK")) returned 1 [0034.425] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tMuxzgPEV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tmuxzgpev.lnk")) returned 0x20 [0034.425] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tMuxzgPEV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tmuxzgpev.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.425] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tMuxzgPEV.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tmuxzgpev.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.426] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xf85, lpOverlapped=0x0) returned 1 [0034.427] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xf85, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xf85, lpOverlapped=0x0) returned 1 [0034.428] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.428] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.428] CloseHandle (hObject=0x104) returned 1 [0034.428] CloseHandle (hObject=0xfc) returned 1 [0034.428] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tMuxzgPEV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tmuxzgpev.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tMuxzgPEV.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tmuxzgpev.lnk.crypt")) returned 0 [0034.428] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tMuxzgPEV.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tmuxzgpev.lnk.crypt")) returned 0x20 [0034.428] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tMuxzgPEV.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98083620, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98083620, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98083620, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf85, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="tMuxzgPEV.lnk", cAlternateFileName="TMUXZG~1.LNK")) returned 0x5c8f80 [0034.428] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98083620, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98083620, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98083620, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf85, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="tMuxzgPEV.lnk", cAlternateFileName="TMUXZG~1.LNK")) returned 0 [0034.428] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.428] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tMuxzgPEV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tmuxzgpev.lnk")) returned 1 [0034.429] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tMuxzgPEV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tmuxzgpev.lnk")) returned 0xffffffff [0034.429] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9818dfc0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9818dfc0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x981b4120, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="tSfS3txBVOn8wL_501.lnk", cAlternateFileName="TSFS3T~1.LNK")) returned 1 [0034.429] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tSfS3txBVOn8wL_501.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsfs3txbvon8wl_501.lnk")) returned 0x20 [0034.429] VirtualAlloc (lpAddress=0x3178000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3178000 [0034.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tSfS3txBVOn8wL_501.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsfs3txbvon8wl_501.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tSfS3txBVOn8wL_501.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsfs3txbvon8wl_501.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.430] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa8f, lpOverlapped=0x0) returned 1 [0034.431] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa8f, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa8f, lpOverlapped=0x0) returned 1 [0034.432] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.432] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.432] CloseHandle (hObject=0xfc) returned 1 [0034.432] CloseHandle (hObject=0x104) returned 1 [0034.432] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tSfS3txBVOn8wL_501.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsfs3txbvon8wl_501.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tSfS3txBVOn8wL_501.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsfs3txbvon8wl_501.lnk.crypt")) returned 0 [0034.433] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tSfS3txBVOn8wL_501.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsfs3txbvon8wl_501.lnk.crypt")) returned 0x20 [0034.433] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tSfS3txBVOn8wL_501.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9818dfc0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9818dfc0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x981b4120, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="tSfS3txBVOn8wL_501.lnk", cAlternateFileName="TSFS3T~1.LNK")) returned 0x5c8f80 [0034.433] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9818dfc0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9818dfc0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x981b4120, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="tSfS3txBVOn8wL_501.lnk", cAlternateFileName="TSFS3T~1.LNK")) returned 0 [0034.433] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.433] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tSfS3txBVOn8wL_501.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsfs3txbvon8wl_501.lnk")) returned 1 [0034.434] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tSfS3txBVOn8wL_501.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsfs3txbvon8wl_501.lnk")) returned 0xffffffff [0034.434] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97feb0a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97feb0a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97feb0a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="uea73UW-Qa5hA_JDTHP.lnk", cAlternateFileName="UEA73U~1.LNK")) returned 1 [0034.434] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uea73UW-Qa5hA_JDTHP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uea73uw-qa5ha_jdthp.lnk")) returned 0x20 [0034.434] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uea73UW-Qa5hA_JDTHP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uea73uw-qa5ha_jdthp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.434] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uea73UW-Qa5hA_JDTHP.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uea73uw-qa5ha_jdthp.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.435] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa8f, lpOverlapped=0x0) returned 1 [0034.435] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa8f, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa8f, lpOverlapped=0x0) returned 1 [0034.436] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.436] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.436] CloseHandle (hObject=0x104) returned 1 [0034.436] CloseHandle (hObject=0xfc) returned 1 [0034.436] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uea73UW-Qa5hA_JDTHP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uea73uw-qa5ha_jdthp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uea73UW-Qa5hA_JDTHP.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uea73uw-qa5ha_jdthp.lnk.crypt")) returned 0 [0034.437] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uea73UW-Qa5hA_JDTHP.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uea73uw-qa5ha_jdthp.lnk.crypt")) returned 0x20 [0034.437] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uea73UW-Qa5hA_JDTHP.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97feb0a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97feb0a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97feb0a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="uea73UW-Qa5hA_JDTHP.lnk", cAlternateFileName="UEA73U~1.LNK")) returned 0x5c8f80 [0034.437] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97feb0a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97feb0a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97feb0a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="uea73UW-Qa5hA_JDTHP.lnk", cAlternateFileName="UEA73U~1.LNK")) returned 0 [0034.437] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.437] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uea73UW-Qa5hA_JDTHP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uea73uw-qa5ha_jdthp.lnk")) returned 1 [0034.438] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uea73UW-Qa5hA_JDTHP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uea73uw-qa5ha_jdthp.lnk")) returned 0xffffffff [0034.438] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976658a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98c442c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98c442c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x90a, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="UIN.lnk", cAlternateFileName="")) returned 1 [0034.438] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UIN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uin.lnk")) returned 0x20 [0034.438] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UIN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uin.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.438] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UIN.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uin.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.439] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x90a, lpOverlapped=0x0) returned 1 [0034.440] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x90a, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x90a, lpOverlapped=0x0) returned 1 [0034.440] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.441] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.441] CloseHandle (hObject=0xfc) returned 1 [0034.441] CloseHandle (hObject=0x104) returned 1 [0034.441] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UIN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uin.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UIN.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uin.lnk.crypt")) returned 0 [0034.441] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UIN.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uin.lnk.crypt")) returned 0x20 [0034.441] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UIN.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976658a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98c442c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98c442c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x90a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="UIN.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.441] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976658a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98c442c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98c442c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x90a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="UIN.lnk", cAlternateFileName="")) returned 0 [0034.441] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.441] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UIN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uin.lnk")) returned 1 [0034.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UIN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\uin.lnk")) returned 0xffffffff [0034.442] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a7b240, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98a7b240, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98a7b240, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1482, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Ur1x3_10TLgwqBBy.flv.lnk", cAlternateFileName="UR1X3_~1.LNK")) returned 1 [0034.442] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ur1x3_10TLgwqBBy.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ur1x3_10tlgwqbby.flv.lnk")) returned 0x20 [0034.442] VirtualAlloc (lpAddress=0x317c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x317c000 [0034.442] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ur1x3_10TLgwqBBy.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ur1x3_10tlgwqbby.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.443] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ur1x3_10TLgwqBBy.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ur1x3_10tlgwqbby.flv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.443] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.444] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.445] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x482, lpOverlapped=0x0) returned 1 [0034.445] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x482, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x482, lpOverlapped=0x0) returned 1 [0034.445] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.445] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.445] CloseHandle (hObject=0x104) returned 1 [0034.445] CloseHandle (hObject=0xfc) returned 1 [0034.445] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ur1x3_10TLgwqBBy.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ur1x3_10tlgwqbby.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ur1x3_10TLgwqBBy.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ur1x3_10tlgwqbby.flv.lnk.crypt")) returned 0 [0034.446] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ur1x3_10TLgwqBBy.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ur1x3_10tlgwqbby.flv.lnk.crypt")) returned 0x20 [0034.446] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ur1x3_10TLgwqBBy.flv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a7b240, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98a7b240, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98a7b240, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1482, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Ur1x3_10TLgwqBBy.flv.lnk", cAlternateFileName="UR1X3_~1.LNK")) returned 0x5c8f80 [0034.446] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a7b240, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98a7b240, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98a7b240, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1482, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Ur1x3_10TLgwqBBy.flv.lnk", cAlternateFileName="UR1X3_~1.LNK")) returned 0 [0034.446] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.446] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ur1x3_10TLgwqBBy.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ur1x3_10tlgwqbby.flv.lnk")) returned 1 [0034.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ur1x3_10TLgwqBBy.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ur1x3_10tlgwqbby.flv.lnk")) returned 0xffffffff [0034.447] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e36d00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996fa5c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996fa5c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe5b, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="v4noN7O sKB.lnk", cAlternateFileName="V4NON7~1.LNK")) returned 1 [0034.447] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v4noN7O sKB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v4non7o skb.lnk")) returned 0x20 [0034.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v4noN7O sKB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v4non7o skb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.447] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v4noN7O sKB.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v4non7o skb.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.448] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xe5b, lpOverlapped=0x0) returned 1 [0034.448] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xe5b, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xe5b, lpOverlapped=0x0) returned 1 [0034.449] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.449] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.449] CloseHandle (hObject=0xfc) returned 1 [0034.449] CloseHandle (hObject=0x104) returned 1 [0034.450] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v4noN7O sKB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v4non7o skb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v4noN7O sKB.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v4non7o skb.lnk.crypt")) returned 0 [0034.450] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v4noN7O sKB.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v4non7o skb.lnk.crypt")) returned 0x20 [0034.450] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v4noN7O sKB.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e36d00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996fa5c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996fa5c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe5b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="v4noN7O sKB.lnk", cAlternateFileName="V4NON7~1.LNK")) returned 0x5c8f80 [0034.450] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e36d00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996fa5c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996fa5c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe5b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="v4noN7O sKB.lnk", cAlternateFileName="V4NON7~1.LNK")) returned 0 [0034.450] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.450] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v4noN7O sKB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v4non7o skb.lnk")) returned 1 [0034.451] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v4noN7O sKB.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\v4non7o skb.lnk")) returned 0xffffffff [0034.451] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9888c060, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9888c060, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9888c060, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="vaCw.lnk", cAlternateFileName="")) returned 1 [0034.451] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vaCw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vacw.lnk")) returned 0x20 [0034.451] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vaCw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vacw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.451] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vaCw.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vacw.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.452] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x9ea, lpOverlapped=0x0) returned 1 [0034.453] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x9ea, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x9ea, lpOverlapped=0x0) returned 1 [0034.454] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.454] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.454] CloseHandle (hObject=0x104) returned 1 [0034.454] CloseHandle (hObject=0xfc) returned 1 [0034.454] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vaCw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vacw.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vaCw.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vacw.lnk.crypt")) returned 0 [0034.454] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vaCw.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vacw.lnk.crypt")) returned 0x20 [0034.454] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vaCw.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9888c060, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9888c060, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9888c060, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="vaCw.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.454] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9888c060, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9888c060, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9888c060, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="vaCw.lnk", cAlternateFileName="")) returned 0 [0034.454] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.454] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vaCw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vacw.lnk")) returned 1 [0034.455] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vaCw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vacw.lnk")) returned 0xffffffff [0034.455] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97c58fa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996881a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996881a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe3a, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="vd8DgU1S.lnk", cAlternateFileName="")) returned 1 [0034.455] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vd8DgU1S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vd8dgu1s.lnk")) returned 0x20 [0034.455] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vd8DgU1S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vd8dgu1s.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.456] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vd8DgU1S.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vd8dgu1s.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.456] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xe3a, lpOverlapped=0x0) returned 1 [0034.457] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xe3a, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xe3a, lpOverlapped=0x0) returned 1 [0034.458] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.458] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.458] CloseHandle (hObject=0xfc) returned 1 [0034.458] CloseHandle (hObject=0x104) returned 1 [0034.458] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vd8DgU1S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vd8dgu1s.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vd8DgU1S.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vd8dgu1s.lnk.crypt")) returned 0 [0034.458] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vd8DgU1S.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vd8dgu1s.lnk.crypt")) returned 0x20 [0034.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vd8DgU1S.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97c58fa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996881a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996881a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe3a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="vd8DgU1S.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.458] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97c58fa0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x996881a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x996881a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe3a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="vd8DgU1S.lnk", cAlternateFileName="")) returned 0 [0034.459] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.459] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vd8DgU1S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vd8dgu1s.lnk")) returned 1 [0034.459] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vd8DgU1S.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vd8dgu1s.lnk")) returned 0xffffffff [0034.459] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9870f2a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9870f2a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9870f2a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGGDFIdk-R.lnk", cAlternateFileName="VGGDFI~1.LNK")) returned 1 [0034.459] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VGGDFIdk-R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vggdfidk-r.lnk")) returned 0x20 [0034.460] VirtualAlloc (lpAddress=0x3180000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3180000 [0034.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VGGDFIdk-R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vggdfidk-r.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VGGDFIdk-R.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vggdfidk-r.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.462] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x3c0, lpOverlapped=0x0) returned 1 [0034.463] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x3c0, lpOverlapped=0x0) returned 1 [0034.464] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.464] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.464] CloseHandle (hObject=0x104) returned 1 [0034.464] CloseHandle (hObject=0xfc) returned 1 [0034.464] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VGGDFIdk-R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vggdfidk-r.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VGGDFIdk-R.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vggdfidk-r.lnk.crypt")) returned 0 [0034.465] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VGGDFIdk-R.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vggdfidk-r.lnk.crypt")) returned 0x20 [0034.465] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VGGDFIdk-R.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9870f2a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9870f2a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9870f2a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="VGGDFIdk-R.lnk", cAlternateFileName="VGGDFI~1.LNK")) returned 0x5c8f80 [0034.465] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9870f2a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9870f2a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9870f2a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="VGGDFIdk-R.lnk", cAlternateFileName="VGGDFI~1.LNK")) returned 0 [0034.465] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.465] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VGGDFIdk-R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vggdfidk-r.lnk")) returned 1 [0034.466] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VGGDFIdk-R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vggdfidk-r.lnk")) returned 0xffffffff [0034.466] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97c7f100, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97c7f100, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97ca5260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa05, dwReserved0=0x0, dwReserved1=0x0, cFileName="VHqzI_mN.lnk", cAlternateFileName="")) returned 1 [0034.466] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VHqzI_mN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vhqzi_mn.lnk")) returned 0x20 [0034.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VHqzI_mN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vhqzi_mn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VHqzI_mN.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vhqzi_mn.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.467] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa05, lpOverlapped=0x0) returned 1 [0034.468] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa05, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa05, lpOverlapped=0x0) returned 1 [0034.468] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.468] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.468] CloseHandle (hObject=0xfc) returned 1 [0034.469] CloseHandle (hObject=0x104) returned 1 [0034.469] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VHqzI_mN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vhqzi_mn.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VHqzI_mN.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vhqzi_mn.lnk.crypt")) returned 0 [0034.469] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VHqzI_mN.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vhqzi_mn.lnk.crypt")) returned 0x20 [0034.469] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VHqzI_mN.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97c7f100, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97c7f100, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97ca5260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa05, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="VHqzI_mN.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.469] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97c7f100, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97c7f100, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97ca5260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa05, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="VHqzI_mN.lnk", cAlternateFileName="")) returned 0 [0034.469] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.469] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VHqzI_mN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vhqzi_mn.lnk")) returned 1 [0034.470] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VHqzI_mN.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vhqzi_mn.lnk")) returned 0xffffffff [0034.470] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x985200c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x985200c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x985200c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa88, dwReserved0=0x0, dwReserved1=0x0, cFileName="vinoLwfUsbpS4BWLGW.lnk", cAlternateFileName="VINOLW~1.LNK")) returned 1 [0034.470] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vinoLwfUsbpS4BWLGW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vinolwfusbps4bwlgw.lnk")) returned 0x20 [0034.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vinoLwfUsbpS4BWLGW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vinolwfusbps4bwlgw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.470] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vinoLwfUsbpS4BWLGW.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vinolwfusbps4bwlgw.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.471] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa88, lpOverlapped=0x0) returned 1 [0034.472] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa88, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa88, lpOverlapped=0x0) returned 1 [0034.473] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.473] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.473] CloseHandle (hObject=0x104) returned 1 [0034.473] CloseHandle (hObject=0xfc) returned 1 [0034.473] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vinoLwfUsbpS4BWLGW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vinolwfusbps4bwlgw.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vinoLwfUsbpS4BWLGW.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vinolwfusbps4bwlgw.lnk.crypt")) returned 0 [0034.473] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vinoLwfUsbpS4BWLGW.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vinolwfusbps4bwlgw.lnk.crypt")) returned 0x20 [0034.473] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vinoLwfUsbpS4BWLGW.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x985200c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x985200c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x985200c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa88, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="vinoLwfUsbpS4BWLGW.lnk", cAlternateFileName="VINOLW~1.LNK")) returned 0x5c8f80 [0034.473] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x985200c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x985200c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x985200c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa88, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="vinoLwfUsbpS4BWLGW.lnk", cAlternateFileName="VINOLW~1.LNK")) returned 0 [0034.473] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.473] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vinoLwfUsbpS4BWLGW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vinolwfusbps4bwlgw.lnk")) returned 1 [0034.474] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vinoLwfUsbpS4BWLGW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vinolwfusbps4bwlgw.lnk")) returned 0xffffffff [0034.474] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98415720, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98415720, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98415720, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="VyfcFK-R3a9.lnk", cAlternateFileName="VYFCFK~1.LNK")) returned 1 [0034.474] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyfcFK-R3a9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vyfcfk-r3a9.lnk")) returned 0x20 [0034.474] VirtualAlloc (lpAddress=0x3184000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3184000 [0034.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyfcFK-R3a9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vyfcfk-r3a9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyfcFK-R3a9.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vyfcfk-r3a9.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.475] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x248, lpOverlapped=0x0) returned 1 [0034.476] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x248, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x248, lpOverlapped=0x0) returned 1 [0034.477] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.477] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.477] CloseHandle (hObject=0xfc) returned 1 [0034.477] CloseHandle (hObject=0x104) returned 1 [0034.477] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyfcFK-R3a9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vyfcfk-r3a9.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyfcFK-R3a9.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vyfcfk-r3a9.lnk.crypt")) returned 0 [0034.477] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyfcFK-R3a9.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vyfcfk-r3a9.lnk.crypt")) returned 0x20 [0034.478] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyfcFK-R3a9.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98415720, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98415720, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98415720, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="VyfcFK-R3a9.lnk", cAlternateFileName="VYFCFK~1.LNK")) returned 0x5c8f80 [0034.478] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98415720, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98415720, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98415720, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="VyfcFK-R3a9.lnk", cAlternateFileName="VYFCFK~1.LNK")) returned 0 [0034.478] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.478] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyfcFK-R3a9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vyfcfk-r3a9.lnk")) returned 1 [0034.479] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VyfcFK-R3a9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vyfcfk-r3a9.lnk")) returned 0xffffffff [0034.479] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x985200c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x985200c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x985200c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wb85quJcmU45C5T.lnk", cAlternateFileName="WB85QU~1.LNK")) returned 1 [0034.479] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wb85quJcmU45C5T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wb85qujcmu45c5t.lnk")) returned 0x20 [0034.479] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wb85quJcmU45C5T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wb85qujcmu45c5t.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.479] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wb85quJcmU45C5T.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wb85qujcmu45c5t.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.480] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa6e, lpOverlapped=0x0) returned 1 [0034.480] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa6e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa6e, lpOverlapped=0x0) returned 1 [0034.481] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.481] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.481] CloseHandle (hObject=0x104) returned 1 [0034.481] CloseHandle (hObject=0xfc) returned 1 [0034.481] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wb85quJcmU45C5T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wb85qujcmu45c5t.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wb85quJcmU45C5T.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wb85qujcmu45c5t.lnk.crypt")) returned 0 [0034.482] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wb85quJcmU45C5T.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wb85qujcmu45c5t.lnk.crypt")) returned 0x20 [0034.482] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wb85quJcmU45C5T.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x985200c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x985200c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x985200c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Wb85quJcmU45C5T.lnk", cAlternateFileName="WB85QU~1.LNK")) returned 0x5c8f80 [0034.482] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x985200c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x985200c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x985200c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Wb85quJcmU45C5T.lnk", cAlternateFileName="WB85QU~1.LNK")) returned 0 [0034.482] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.482] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wb85quJcmU45C5T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wb85qujcmu45c5t.lnk")) returned 1 [0034.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Wb85quJcmU45C5T.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wb85qujcmu45c5t.lnk")) returned 0xffffffff [0034.483] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98cb66e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98cb66e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98cb66e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x0, dwReserved1=0x0, cFileName="wkTfHmhLJX51r8i6Q.lnk", cAlternateFileName="WKTFHM~1.LNK")) returned 1 [0034.483] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wkTfHmhLJX51r8i6Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wktfhmhljx51r8i6q.lnk")) returned 0x20 [0034.483] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wkTfHmhLJX51r8i6Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wktfhmhljx51r8i6q.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.483] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wkTfHmhLJX51r8i6Q.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wktfhmhljx51r8i6q.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.484] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa84, lpOverlapped=0x0) returned 1 [0034.485] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa84, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa84, lpOverlapped=0x0) returned 1 [0034.486] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.486] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.486] CloseHandle (hObject=0xfc) returned 1 [0034.486] CloseHandle (hObject=0x104) returned 1 [0034.486] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wkTfHmhLJX51r8i6Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wktfhmhljx51r8i6q.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wkTfHmhLJX51r8i6Q.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wktfhmhljx51r8i6q.lnk.crypt")) returned 0 [0034.486] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wkTfHmhLJX51r8i6Q.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wktfhmhljx51r8i6q.lnk.crypt")) returned 0x20 [0034.486] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wkTfHmhLJX51r8i6Q.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98cb66e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98cb66e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98cb66e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="wkTfHmhLJX51r8i6Q.lnk", cAlternateFileName="WKTFHM~1.LNK")) returned 0x5c8f80 [0034.487] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98cb66e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98cb66e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98cb66e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="wkTfHmhLJX51r8i6Q.lnk", cAlternateFileName="WKTFHM~1.LNK")) returned 0 [0034.487] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.487] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wkTfHmhLJX51r8i6Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wktfhmhljx51r8i6q.lnk")) returned 1 [0034.488] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wkTfHmhLJX51r8i6Q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wktfhmhljx51r8i6q.lnk")) returned 0xffffffff [0034.488] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984f9f60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x984f9f60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x984f9f60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf9b, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="WPT7UafYBGl.lnk", cAlternateFileName="WPT7UA~1.LNK")) returned 1 [0034.488] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WPT7UafYBGl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpt7uafybgl.lnk")) returned 0x20 [0034.488] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WPT7UafYBGl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpt7uafybgl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.488] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WPT7UafYBGl.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpt7uafybgl.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.488] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xf9b, lpOverlapped=0x0) returned 1 [0034.489] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xf9b, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xf9b, lpOverlapped=0x0) returned 1 [0034.490] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.490] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.490] CloseHandle (hObject=0x104) returned 1 [0034.490] CloseHandle (hObject=0xfc) returned 1 [0034.490] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WPT7UafYBGl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpt7uafybgl.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WPT7UafYBGl.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpt7uafybgl.lnk.crypt")) returned 0 [0034.491] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WPT7UafYBGl.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpt7uafybgl.lnk.crypt")) returned 0x20 [0034.491] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WPT7UafYBGl.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984f9f60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x984f9f60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x984f9f60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf9b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="WPT7UafYBGl.lnk", cAlternateFileName="WPT7UA~1.LNK")) returned 0x5c8f80 [0034.491] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x984f9f60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x984f9f60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x984f9f60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf9b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="WPT7UafYBGl.lnk", cAlternateFileName="WPT7UA~1.LNK")) returned 0 [0034.491] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.491] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WPT7UafYBGl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpt7uafybgl.lnk")) returned 1 [0034.492] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WPT7UafYBGl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wpt7uafybgl.lnk")) returned 0xffffffff [0034.492] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d74dc0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98d74dc0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98d74dc0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="wt5bUzyysPD.lnk", cAlternateFileName="WT5BUZ~1.LNK")) returned 1 [0034.492] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wt5bUzyysPD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wt5buzyyspd.lnk")) returned 0x20 [0034.492] VirtualAlloc (lpAddress=0x3188000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3188000 [0034.492] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wt5bUzyysPD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wt5buzyyspd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.492] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wt5bUzyysPD.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wt5buzyyspd.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.493] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa42, lpOverlapped=0x0) returned 1 [0034.494] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa42, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa42, lpOverlapped=0x0) returned 1 [0034.495] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.495] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.495] CloseHandle (hObject=0xfc) returned 1 [0034.495] CloseHandle (hObject=0x104) returned 1 [0034.495] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wt5bUzyysPD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wt5buzyyspd.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wt5bUzyysPD.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wt5buzyyspd.lnk.crypt")) returned 0 [0034.495] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wt5bUzyysPD.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wt5buzyyspd.lnk.crypt")) returned 0x20 [0034.495] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wt5bUzyysPD.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d74dc0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98d74dc0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98d74dc0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="wt5bUzyysPD.lnk", cAlternateFileName="WT5BUZ~1.LNK")) returned 0x5c8f80 [0034.496] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d74dc0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98d74dc0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98d74dc0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="wt5bUzyysPD.lnk", cAlternateFileName="WT5BUZ~1.LNK")) returned 0 [0034.496] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.496] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wt5bUzyysPD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wt5buzyyspd.lnk")) returned 1 [0034.496] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wt5bUzyysPD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wt5buzyyspd.lnk")) returned 0xffffffff [0034.497] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d524c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96d524c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96d524c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WZ3imSrZcPAEZqerhj.lnk", cAlternateFileName="WZ3IMS~1.LNK")) returned 1 [0034.497] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WZ3imSrZcPAEZqerhj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wz3imsrzcpaezqerhj.lnk")) returned 0x20 [0034.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WZ3imSrZcPAEZqerhj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wz3imsrzcpaezqerhj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WZ3imSrZcPAEZqerhj.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wz3imsrzcpaezqerhj.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.497] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa8f, lpOverlapped=0x0) returned 1 [0034.498] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa8f, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa8f, lpOverlapped=0x0) returned 1 [0034.499] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.499] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.499] CloseHandle (hObject=0x104) returned 1 [0034.499] CloseHandle (hObject=0xfc) returned 1 [0034.499] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WZ3imSrZcPAEZqerhj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wz3imsrzcpaezqerhj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WZ3imSrZcPAEZqerhj.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wz3imsrzcpaezqerhj.lnk.crypt")) returned 0 [0034.500] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WZ3imSrZcPAEZqerhj.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wz3imsrzcpaezqerhj.lnk.crypt")) returned 0x20 [0034.500] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WZ3imSrZcPAEZqerhj.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d524c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96d524c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96d524c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="WZ3imSrZcPAEZqerhj.lnk", cAlternateFileName="WZ3IMS~1.LNK")) returned 0x5c8f80 [0034.500] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d524c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96d524c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96d524c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="WZ3imSrZcPAEZqerhj.lnk", cAlternateFileName="WZ3IMS~1.LNK")) returned 0 [0034.500] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.500] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WZ3imSrZcPAEZqerhj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wz3imsrzcpaezqerhj.lnk")) returned 1 [0034.501] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WZ3imSrZcPAEZqerhj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wz3imsrzcpaezqerhj.lnk")) returned 0xffffffff [0034.501] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b85be0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98b85be0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98b85be0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="x5-hMMhjBt-u0xNu.flv.lnk", cAlternateFileName="X5-HMM~1.LNK")) returned 1 [0034.501] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x5-hMMhjBt-u0xNu.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x5-hmmhjbt-u0xnu.flv.lnk")) returned 0x20 [0034.501] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x5-hMMhjBt-u0xNu.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x5-hmmhjbt-u0xnu.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.501] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x5-hMMhjBt-u0xNu.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x5-hmmhjbt-u0xnu.flv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.502] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x3de, lpOverlapped=0x0) returned 1 [0034.503] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x3de, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x3de, lpOverlapped=0x0) returned 1 [0034.504] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.504] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.504] CloseHandle (hObject=0xfc) returned 1 [0034.504] CloseHandle (hObject=0x104) returned 1 [0034.504] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x5-hMMhjBt-u0xNu.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x5-hmmhjbt-u0xnu.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x5-hMMhjBt-u0xNu.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x5-hmmhjbt-u0xnu.flv.lnk.crypt")) returned 0 [0034.504] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x5-hMMhjBt-u0xNu.flv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x5-hmmhjbt-u0xnu.flv.lnk.crypt")) returned 0x20 [0034.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x5-hMMhjBt-u0xNu.flv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b85be0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98b85be0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98b85be0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="x5-hMMhjBt-u0xNu.flv.lnk", cAlternateFileName="X5-HMM~1.LNK")) returned 0x5c8f80 [0034.504] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98b85be0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98b85be0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98b85be0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="x5-hMMhjBt-u0xNu.flv.lnk", cAlternateFileName="X5-HMM~1.LNK")) returned 0 [0034.504] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.504] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x5-hMMhjBt-u0xNu.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x5-hmmhjbt-u0xnu.flv.lnk")) returned 1 [0034.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x5-hMMhjBt-u0xNu.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x5-hmmhjbt-u0xnu.flv.lnk")) returned 0xffffffff [0034.505] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9717cb40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9717cb40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9717cb40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="X53u2qVjhd-p.lnk", cAlternateFileName="X53U2Q~1.LNK")) returned 1 [0034.505] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X53u2qVjhd-p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x53u2qvjhd-p.lnk")) returned 0x20 [0034.505] VirtualAlloc (lpAddress=0x318c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x318c000 [0034.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X53u2qVjhd-p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x53u2qvjhd-p.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X53u2qVjhd-p.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x53u2qvjhd-p.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.506] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa4d, lpOverlapped=0x0) returned 1 [0034.507] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa4d, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa4d, lpOverlapped=0x0) returned 1 [0034.508] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.508] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.508] CloseHandle (hObject=0x104) returned 1 [0034.508] CloseHandle (hObject=0xfc) returned 1 [0034.508] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X53u2qVjhd-p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x53u2qvjhd-p.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X53u2qVjhd-p.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x53u2qvjhd-p.lnk.crypt")) returned 0 [0034.508] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X53u2qVjhd-p.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x53u2qvjhd-p.lnk.crypt")) returned 0x20 [0034.508] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X53u2qVjhd-p.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9717cb40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9717cb40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9717cb40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="X53u2qVjhd-p.lnk", cAlternateFileName="X53U2Q~1.LNK")) returned 0x5c8f80 [0034.509] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9717cb40, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9717cb40, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9717cb40, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="X53u2qVjhd-p.lnk", cAlternateFileName="X53U2Q~1.LNK")) returned 0 [0034.509] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.509] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X53u2qVjhd-p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x53u2qvjhd-p.lnk")) returned 1 [0034.509] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\X53u2qVjhd-p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\x53u2qvjhd-p.lnk")) returned 0xffffffff [0034.509] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x977e2660, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x977e2660, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x977e2660, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="XCE6mWPwu1m.lnk", cAlternateFileName="XCE6MW~1.LNK")) returned 1 [0034.510] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XCE6mWPwu1m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xce6mwpwu1m.lnk")) returned 0x20 [0034.510] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XCE6mWPwu1m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xce6mwpwu1m.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.510] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XCE6mWPwu1m.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xce6mwpwu1m.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.510] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa42, lpOverlapped=0x0) returned 1 [0034.511] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa42, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa42, lpOverlapped=0x0) returned 1 [0034.512] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.512] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.512] CloseHandle (hObject=0xfc) returned 1 [0034.512] CloseHandle (hObject=0x104) returned 1 [0034.512] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XCE6mWPwu1m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xce6mwpwu1m.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XCE6mWPwu1m.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xce6mwpwu1m.lnk.crypt")) returned 0 [0034.513] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XCE6mWPwu1m.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xce6mwpwu1m.lnk.crypt")) returned 0x20 [0034.513] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XCE6mWPwu1m.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x977e2660, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x977e2660, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x977e2660, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="XCE6mWPwu1m.lnk", cAlternateFileName="XCE6MW~1.LNK")) returned 0x5c8f80 [0034.513] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x977e2660, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x977e2660, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x977e2660, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="XCE6mWPwu1m.lnk", cAlternateFileName="XCE6MW~1.LNK")) returned 0 [0034.513] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.513] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XCE6mWPwu1m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xce6mwpwu1m.lnk")) returned 1 [0034.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XCE6mWPwu1m.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xce6mwpwu1m.lnk")) returned 0xffffffff [0034.514] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989bcb60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x989bcb60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x989bcb60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x0, dwReserved1=0x0, cFileName="XsD0o5hKl2npcDCg2IIF.lnk", cAlternateFileName="XSD0O5~1.LNK")) returned 1 [0034.514] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsD0o5hKl2npcDCg2IIF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xsd0o5hkl2npcdcg2iif.lnk")) returned 0x20 [0034.514] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsD0o5hKl2npcDCg2IIF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xsd0o5hkl2npcdcg2iif.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.514] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsD0o5hKl2npcDCg2IIF.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xsd0o5hkl2npcdcg2iif.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.515] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa89, lpOverlapped=0x0) returned 1 [0034.515] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa89, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa89, lpOverlapped=0x0) returned 1 [0034.516] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.517] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.517] CloseHandle (hObject=0x104) returned 1 [0034.517] CloseHandle (hObject=0xfc) returned 1 [0034.517] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsD0o5hKl2npcDCg2IIF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xsd0o5hkl2npcdcg2iif.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsD0o5hKl2npcDCg2IIF.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xsd0o5hkl2npcdcg2iif.lnk.crypt")) returned 0 [0034.517] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsD0o5hKl2npcDCg2IIF.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xsd0o5hkl2npcdcg2iif.lnk.crypt")) returned 0x20 [0034.517] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsD0o5hKl2npcDCg2IIF.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989bcb60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x989bcb60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x989bcb60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="XsD0o5hKl2npcDCg2IIF.lnk", cAlternateFileName="XSD0O5~1.LNK")) returned 0x5c8f80 [0034.517] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989bcb60, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x989bcb60, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x989bcb60, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="XsD0o5hKl2npcDCg2IIF.lnk", cAlternateFileName="XSD0O5~1.LNK")) returned 0 [0034.517] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.517] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsD0o5hKl2npcDCg2IIF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xsd0o5hkl2npcdcg2iif.lnk")) returned 1 [0034.518] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsD0o5hKl2npcDCg2IIF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xsd0o5hkl2npcdcg2iif.lnk")) returned 0xffffffff [0034.518] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971569e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x971569e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x971569e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="xt_DmRSH-_4BV2SH9.ots.lnk", cAlternateFileName="XT_DMR~1.LNK")) returned 1 [0034.518] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xt_DmRSH-_4BV2SH9.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xt_dmrsh-_4bv2sh9.ots.lnk")) returned 0x20 [0034.518] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xt_DmRSH-_4BV2SH9.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xt_dmrsh-_4bv2sh9.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.519] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xt_DmRSH-_4BV2SH9.ots.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xt_dmrsh-_4bv2sh9.ots.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.519] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa58, lpOverlapped=0x0) returned 1 [0034.520] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa58, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa58, lpOverlapped=0x0) returned 1 [0034.521] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.521] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.521] CloseHandle (hObject=0xfc) returned 1 [0034.521] CloseHandle (hObject=0x104) returned 1 [0034.521] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xt_DmRSH-_4BV2SH9.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xt_dmrsh-_4bv2sh9.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xt_DmRSH-_4BV2SH9.ots.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xt_dmrsh-_4bv2sh9.ots.lnk.crypt")) returned 0 [0034.521] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xt_DmRSH-_4BV2SH9.ots.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xt_dmrsh-_4bv2sh9.ots.lnk.crypt")) returned 0x20 [0034.521] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xt_DmRSH-_4BV2SH9.ots.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971569e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x971569e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x971569e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="xt_DmRSH-_4BV2SH9.ots.lnk", cAlternateFileName="XT_DMR~1.LNK")) returned 0x5c8f80 [0034.521] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971569e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x971569e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x971569e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="xt_DmRSH-_4BV2SH9.ots.lnk", cAlternateFileName="XT_DMR~1.LNK")) returned 0 [0034.521] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.521] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xt_DmRSH-_4BV2SH9.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xt_dmrsh-_4bv2sh9.ots.lnk")) returned 1 [0034.522] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xt_DmRSH-_4BV2SH9.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xt_dmrsh-_4bv2sh9.ots.lnk")) returned 0xffffffff [0034.522] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9837d1a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9837d1a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x983a3300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="XU7TpXHMTpi3hxEYx5.lnk", cAlternateFileName="XU7TPX~1.LNK")) returned 1 [0034.522] VirtualAlloc (lpAddress=0x3190000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3190000 [0034.523] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XU7TpXHMTpi3hxEYx5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xu7tpxhmtpi3hxeyx5.lnk")) returned 0x20 [0034.523] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XU7TpXHMTpi3hxEYx5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xu7tpxhmtpi3hxeyx5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.523] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XU7TpXHMTpi3hxEYx5.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xu7tpxhmtpi3hxeyx5.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.524] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x41a, lpOverlapped=0x0) returned 1 [0034.525] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x41a, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x41a, lpOverlapped=0x0) returned 1 [0034.525] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.525] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.526] CloseHandle (hObject=0x104) returned 1 [0034.526] CloseHandle (hObject=0xfc) returned 1 [0034.526] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XU7TpXHMTpi3hxEYx5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xu7tpxhmtpi3hxeyx5.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XU7TpXHMTpi3hxEYx5.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xu7tpxhmtpi3hxeyx5.lnk.crypt")) returned 0 [0034.526] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XU7TpXHMTpi3hxEYx5.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xu7tpxhmtpi3hxeyx5.lnk.crypt")) returned 0x20 [0034.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XU7TpXHMTpi3hxEYx5.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9837d1a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9837d1a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x983a3300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="XU7TpXHMTpi3hxEYx5.lnk", cAlternateFileName="XU7TPX~1.LNK")) returned 0x5c8f80 [0034.526] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9837d1a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9837d1a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x983a3300, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="XU7TpXHMTpi3hxEYx5.lnk", cAlternateFileName="XU7TPX~1.LNK")) returned 0 [0034.526] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.526] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XU7TpXHMTpi3hxEYx5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xu7tpxhmtpi3hxeyx5.lnk")) returned 1 [0034.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XU7TpXHMTpi3hxEYx5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xu7tpxhmtpi3hxeyx5.lnk")) returned 0xffffffff [0034.527] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x977963a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x977963a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x977963a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="xWeKX.lnk", cAlternateFileName="")) returned 1 [0034.527] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWeKX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xwekx.lnk")) returned 0x20 [0034.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWeKX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xwekx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWeKX.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xwekx.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.528] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa00, lpOverlapped=0x0) returned 1 [0034.529] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa00, lpOverlapped=0x0) returned 1 [0034.530] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.530] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.530] CloseHandle (hObject=0xfc) returned 1 [0034.530] CloseHandle (hObject=0x104) returned 1 [0034.530] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWeKX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xwekx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWeKX.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xwekx.lnk.crypt")) returned 0 [0034.530] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWeKX.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xwekx.lnk.crypt")) returned 0x20 [0034.530] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWeKX.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x977963a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x977963a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x977963a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="xWeKX.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.530] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x977963a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x977963a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x977963a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="xWeKX.lnk", cAlternateFileName="")) returned 0 [0034.531] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.531] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWeKX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xwekx.lnk")) returned 1 [0034.532] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWeKX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xwekx.lnk")) returned 0xffffffff [0034.532] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9843b880, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9843b880, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9843b880, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="XY9FEIK2DpgtI.lnk", cAlternateFileName="XY9FEI~1.LNK")) returned 1 [0034.532] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XY9FEIK2DpgtI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xy9feik2dpgti.lnk")) returned 0x20 [0034.532] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XY9FEIK2DpgtI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xy9feik2dpgti.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.532] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XY9FEIK2DpgtI.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xy9feik2dpgti.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.533] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa38, lpOverlapped=0x0) returned 1 [0034.533] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa38, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa38, lpOverlapped=0x0) returned 1 [0034.534] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.534] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.534] CloseHandle (hObject=0x104) returned 1 [0034.534] CloseHandle (hObject=0xfc) returned 1 [0034.534] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XY9FEIK2DpgtI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xy9feik2dpgti.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XY9FEIK2DpgtI.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xy9feik2dpgti.lnk.crypt")) returned 0 [0034.535] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XY9FEIK2DpgtI.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xy9feik2dpgti.lnk.crypt")) returned 0x20 [0034.535] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XY9FEIK2DpgtI.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9843b880, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9843b880, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9843b880, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="XY9FEIK2DpgtI.lnk", cAlternateFileName="XY9FEI~1.LNK")) returned 0x5c8f80 [0034.535] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9843b880, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9843b880, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9843b880, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="XY9FEIK2DpgtI.lnk", cAlternateFileName="XY9FEI~1.LNK")) returned 0 [0034.535] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.535] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XY9FEIK2DpgtI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xy9feik2dpgti.lnk")) returned 1 [0034.536] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XY9FEIK2DpgtI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xy9feik2dpgti.lnk")) returned 0xffffffff [0034.536] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ca5260, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97ca5260, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97ca5260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="yPs6sZU6g.lnk", cAlternateFileName="YPS6SZ~1.LNK")) returned 1 [0034.536] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yPs6sZU6g.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yps6szu6g.lnk")) returned 0x20 [0034.536] VirtualAlloc (lpAddress=0x3194000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3194000 [0034.536] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yPs6sZU6g.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yps6szu6g.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.536] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yPs6sZU6g.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yps6szu6g.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.537] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x2f2, lpOverlapped=0x0) returned 1 [0034.538] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x2f2, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x2f2, lpOverlapped=0x0) returned 1 [0034.539] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.539] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.539] CloseHandle (hObject=0xfc) returned 1 [0034.539] CloseHandle (hObject=0x104) returned 1 [0034.539] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yPs6sZU6g.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yps6szu6g.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yPs6sZU6g.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yps6szu6g.lnk.crypt")) returned 0 [0034.539] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yPs6sZU6g.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yps6szu6g.lnk.crypt")) returned 0x20 [0034.539] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yPs6sZU6g.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ca5260, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97ca5260, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97ca5260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2f2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="yPs6sZU6g.lnk", cAlternateFileName="YPS6SZ~1.LNK")) returned 0x5c8f80 [0034.539] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ca5260, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97ca5260, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97ca5260, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2f2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="yPs6sZU6g.lnk", cAlternateFileName="YPS6SZ~1.LNK")) returned 0 [0034.539] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.539] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yPs6sZU6g.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yps6szu6g.lnk")) returned 1 [0034.540] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yPs6sZU6g.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yps6szu6g.lnk")) returned 0xffffffff [0034.540] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9811bba0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9811bba0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9811bba0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVs8isf1eAN_oRcfI.mkv.lnk", cAlternateFileName="YVS8IS~1.LNK")) returned 1 [0034.540] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YVs8isf1eAN_oRcfI.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yvs8isf1ean_orcfi.mkv.lnk")) returned 0x20 [0034.540] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YVs8isf1eAN_oRcfI.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yvs8isf1ean_orcfi.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.541] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YVs8isf1eAN_oRcfI.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yvs8isf1ean_orcfi.mkv.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.541] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.542] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.543] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x434, lpOverlapped=0x0) returned 1 [0034.543] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x434, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x434, lpOverlapped=0x0) returned 1 [0034.543] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.543] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.543] CloseHandle (hObject=0x104) returned 1 [0034.543] CloseHandle (hObject=0xfc) returned 1 [0034.543] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YVs8isf1eAN_oRcfI.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yvs8isf1ean_orcfi.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YVs8isf1eAN_oRcfI.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yvs8isf1ean_orcfi.mkv.lnk.crypt")) returned 0 [0034.544] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YVs8isf1eAN_oRcfI.mkv.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yvs8isf1ean_orcfi.mkv.lnk.crypt")) returned 0x20 [0034.544] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YVs8isf1eAN_oRcfI.mkv.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9811bba0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9811bba0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9811bba0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="YVs8isf1eAN_oRcfI.mkv.lnk", cAlternateFileName="YVS8IS~1.LNK")) returned 0x5c8f80 [0034.544] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9811bba0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9811bba0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9811bba0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="YVs8isf1eAN_oRcfI.mkv.lnk", cAlternateFileName="YVS8IS~1.LNK")) returned 0 [0034.544] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.544] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YVs8isf1eAN_oRcfI.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yvs8isf1ean_orcfi.mkv.lnk")) returned 1 [0034.545] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YVs8isf1eAN_oRcfI.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yvs8isf1ean_orcfi.mkv.lnk")) returned 0xffffffff [0034.545] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d28b00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98d28b00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98d28b00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa72, dwReserved0=0x0, dwReserved1=0x0, cFileName="YxcWeP1oYdIJLC6u.lnk", cAlternateFileName="YXCWEP~1.LNK")) returned 1 [0034.545] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YxcWeP1oYdIJLC6u.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yxcwep1oydijlc6u.lnk")) returned 0x20 [0034.545] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YxcWeP1oYdIJLC6u.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yxcwep1oydijlc6u.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.545] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YxcWeP1oYdIJLC6u.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yxcwep1oydijlc6u.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.546] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa72, lpOverlapped=0x0) returned 1 [0034.546] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa72, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa72, lpOverlapped=0x0) returned 1 [0034.548] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.548] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.548] CloseHandle (hObject=0xfc) returned 1 [0034.548] CloseHandle (hObject=0x104) returned 1 [0034.548] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YxcWeP1oYdIJLC6u.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yxcwep1oydijlc6u.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YxcWeP1oYdIJLC6u.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yxcwep1oydijlc6u.lnk.crypt")) returned 0 [0034.548] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YxcWeP1oYdIJLC6u.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yxcwep1oydijlc6u.lnk.crypt")) returned 0x20 [0034.548] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YxcWeP1oYdIJLC6u.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d28b00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98d28b00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98d28b00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa72, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="YxcWeP1oYdIJLC6u.lnk", cAlternateFileName="YXCWEP~1.LNK")) returned 0x5c8f80 [0034.548] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98d28b00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x98d28b00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x98d28b00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa72, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="YxcWeP1oYdIJLC6u.lnk", cAlternateFileName="YXCWEP~1.LNK")) returned 0 [0034.548] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.548] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YxcWeP1oYdIJLC6u.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yxcwep1oydijlc6u.lnk")) returned 1 [0034.549] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YxcWeP1oYdIJLC6u.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yxcwep1oydijlc6u.lnk")) returned 0xffffffff [0034.549] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972ad640, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x972ad640, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x972ad640, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z1wt.lnk", cAlternateFileName="")) returned 1 [0034.549] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z1wt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z1wt.lnk")) returned 0x20 [0034.549] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z1wt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z1wt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.550] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z1wt.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z1wt.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.550] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x9ea, lpOverlapped=0x0) returned 1 [0034.551] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x9ea, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x9ea, lpOverlapped=0x0) returned 1 [0034.552] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.552] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.552] CloseHandle (hObject=0x104) returned 1 [0034.552] CloseHandle (hObject=0xfc) returned 1 [0034.552] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z1wt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z1wt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z1wt.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z1wt.lnk.crypt")) returned 0 [0034.552] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z1wt.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z1wt.lnk.crypt")) returned 0x20 [0034.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z1wt.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972ad640, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x972ad640, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x972ad640, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Z1wt.lnk", cAlternateFileName="")) returned 0x5c8f80 [0034.552] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972ad640, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x972ad640, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x972ad640, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Z1wt.lnk", cAlternateFileName="")) returned 0 [0034.552] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.553] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z1wt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z1wt.lnk")) returned 1 [0034.553] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z1wt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\z1wt.lnk")) returned 0xffffffff [0034.553] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971569e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x971569e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x971569e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="ZBK1QvsIC2F.lnk", cAlternateFileName="ZBK1QV~1.LNK")) returned 1 [0034.553] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBK1QvsIC2F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbk1qvsic2f.lnk")) returned 0x20 [0034.554] VirtualAlloc (lpAddress=0x3198000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3198000 [0034.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBK1QvsIC2F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbk1qvsic2f.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBK1QvsIC2F.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbk1qvsic2f.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.556] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xa42, lpOverlapped=0x0) returned 1 [0034.556] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xa42, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xa42, lpOverlapped=0x0) returned 1 [0034.557] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.557] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.557] CloseHandle (hObject=0xfc) returned 1 [0034.557] CloseHandle (hObject=0x104) returned 1 [0034.557] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBK1QvsIC2F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbk1qvsic2f.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBK1QvsIC2F.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbk1qvsic2f.lnk.crypt")) returned 0 [0034.558] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBK1QvsIC2F.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbk1qvsic2f.lnk.crypt")) returned 0x20 [0034.558] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBK1QvsIC2F.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971569e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x971569e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x971569e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="ZBK1QvsIC2F.lnk", cAlternateFileName="ZBK1QV~1.LNK")) returned 0x5c8f80 [0034.558] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x971569e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x971569e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x971569e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="ZBK1QvsIC2F.lnk", cAlternateFileName="ZBK1QV~1.LNK")) returned 0 [0034.558] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.558] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBK1QvsIC2F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbk1qvsic2f.lnk")) returned 1 [0034.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBK1QvsIC2F.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbk1qvsic2f.lnk")) returned 0xffffffff [0034.559] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9824c6a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9824c6a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9824c6a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x0, dwReserved1=0x0, cFileName="zGYsNXFxx3.lnk", cAlternateFileName="ZGYSNX~1.LNK")) returned 1 [0034.559] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGYsNXFxx3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zgysnxfxx3.lnk")) returned 0x20 [0034.559] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGYsNXFxx3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zgysnxfxx3.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.559] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGYsNXFxx3.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zgysnxfxx3.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.560] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xf94, lpOverlapped=0x0) returned 1 [0034.561] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xf94, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xf94, lpOverlapped=0x0) returned 1 [0034.561] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.562] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.562] CloseHandle (hObject=0x104) returned 1 [0034.562] CloseHandle (hObject=0xfc) returned 1 [0034.562] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGYsNXFxx3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zgysnxfxx3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGYsNXFxx3.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zgysnxfxx3.lnk.crypt")) returned 0 [0034.562] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGYsNXFxx3.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zgysnxfxx3.lnk.crypt")) returned 0x20 [0034.562] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGYsNXFxx3.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9824c6a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9824c6a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9824c6a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="zGYsNXFxx3.lnk", cAlternateFileName="ZGYSNX~1.LNK")) returned 0x5c8f80 [0034.562] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9824c6a0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9824c6a0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9824c6a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="zGYsNXFxx3.lnk", cAlternateFileName="ZGYSNX~1.LNK")) returned 0 [0034.562] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.562] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGYsNXFxx3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zgysnxfxx3.lnk")) returned 1 [0034.563] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zGYsNXFxx3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zgysnxfxx3.lnk")) returned 0xffffffff [0034.563] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97723f80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97723f80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97723f80, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x0, dwReserved1=0x0, cFileName="_zV ld0rkKX1LQg7da.lnk", cAlternateFileName="_ZVLD0~1.LNK")) returned 1 [0034.563] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_zV ld0rkKX1LQg7da.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_zv ld0rkkx1lqg7da.lnk")) returned 0x20 [0034.563] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_zV ld0rkKX1LQg7da.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_zv ld0rkkx1lqg7da.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.564] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_zV ld0rkKX1LQg7da.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_zv ld0rkkx1lqg7da.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.564] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x26b, lpOverlapped=0x0) returned 1 [0034.565] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x26b, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x26b, lpOverlapped=0x0) returned 1 [0034.566] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.566] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.566] CloseHandle (hObject=0xfc) returned 1 [0034.566] CloseHandle (hObject=0x104) returned 1 [0034.566] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_zV ld0rkKX1LQg7da.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_zv ld0rkkx1lqg7da.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_zV ld0rkKX1LQg7da.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_zv ld0rkkx1lqg7da.lnk.crypt")) returned 0 [0034.567] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_zV ld0rkKX1LQg7da.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_zv ld0rkkx1lqg7da.lnk.crypt")) returned 0x20 [0034.567] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_zV ld0rkKX1LQg7da.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97723f80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97723f80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97723f80, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="_zV ld0rkKX1LQg7da.lnk", cAlternateFileName="_ZVLD0~1.LNK")) returned 0x5c8f80 [0034.567] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97723f80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97723f80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97723f80, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="_zV ld0rkKX1LQg7da.lnk", cAlternateFileName="_ZVLD0~1.LNK")) returned 0 [0034.567] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.567] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_zV ld0rkKX1LQg7da.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_zv ld0rkkx1lqg7da.lnk")) returned 1 [0034.568] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_zV ld0rkKX1LQg7da.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_zv ld0rkkx1lqg7da.lnk")) returned 0xffffffff [0034.568] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97723f80, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x97723f80, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x97723f80, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x0, dwReserved1=0x0, cFileName="_zV ld0rkKX1LQg7da.lnk", cAlternateFileName="_ZVLD0~1.LNK")) returned 0 [0034.568] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0034.568] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67514c31, dwReserved1=0x2e616437, cFileName="SendTo", cAlternateFileName="")) returned 1 [0034.568] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0034.570] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0034.570] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0034.570] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0034.570] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0034.570] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 0x2026 [0034.570] VirtualAlloc (lpAddress=0x319c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x319c000 [0034.571] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.571] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.571] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x22e, lpOverlapped=0x0) returned 1 [0034.572] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x22e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x22e, lpOverlapped=0x0) returned 1 [0034.573] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.573] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.573] CloseHandle (hObject=0x104) returned 1 [0034.573] CloseHandle (hObject=0xfc) returned 1 [0034.573] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.crypt")) returned 0 [0034.573] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.crypt")) returned 0x2020 [0034.573] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0034.574] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0034.574] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.574] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 1 [0034.574] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 0xffffffff [0034.574] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1 [0034.574] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 1 [0034.575] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 0x2020 [0034.575] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.575] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.575] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4d6, lpOverlapped=0x0) returned 1 [0034.577] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4d6, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4d6, lpOverlapped=0x0) returned 1 [0034.577] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.578] WriteFile (in: hFile=0x104, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.578] CloseHandle (hObject=0xfc) returned 1 [0034.578] CloseHandle (hObject=0x104) returned 1 [0034.578] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.crypt")) returned 0 [0034.578] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.crypt")) returned 0x2020 [0034.578] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 0x5c8f80 [0034.578] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 0 [0034.578] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.578] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 1 [0034.579] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 0xffffffff [0034.579] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0034.579] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0034.579] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0034.579] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0034.579] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0034.579] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.579] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.579] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini")) returned 0x6 [0034.580] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.580] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.580] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xae, lpOverlapped=0x0) returned 1 [0034.581] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xae, lpOverlapped=0x0) returned 1 [0034.582] ReadFile (in: hFile=0x104, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.582] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.582] CloseHandle (hObject=0x104) returned 1 [0034.582] CloseHandle (hObject=0xfc) returned 1 [0034.582] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.crypt")) returned 0 [0034.583] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.crypt")) returned 0x20 [0034.583] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0034.583] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.583] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.583] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini")) returned 1 [0034.584] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini")) returned 0xffffffff [0034.584] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0034.584] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0034.584] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.584] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0034.584] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0034.584] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.584] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0034.584] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0034.585] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.585] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0034.585] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 0x26 [0034.585] VirtualAlloc (lpAddress=0x31a0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31a0000 [0034.585] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.585] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.586] ReadFile (in: hFile=0x108, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2c0, lpOverlapped=0x0) returned 1 [0034.587] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2c0, lpOverlapped=0x0) returned 1 [0034.588] ReadFile (in: hFile=0x108, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.588] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.588] CloseHandle (hObject=0x108) returned 1 [0034.588] CloseHandle (hObject=0x100) returned 1 [0034.588] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.crypt")) returned 0 [0034.588] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.crypt")) returned 0x20 [0034.588] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c9040 [0034.588] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0034.588] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0034.589] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 1 [0034.589] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 0xffffffff [0034.589] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 1 [0034.589] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 0x20 [0034.591] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.591] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.593] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x54e, lpOverlapped=0x0) returned 1 [0034.594] WriteFile (in: hFile=0x108, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x54e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x54e, lpOverlapped=0x0) returned 1 [0034.595] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.595] WriteFile (in: hFile=0x108, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.595] CloseHandle (hObject=0x100) returned 1 [0034.595] CloseHandle (hObject=0x108) returned 1 [0034.595] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.crypt")) returned 0 [0034.595] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.crypt")) returned 0x20 [0034.596] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 0x5c9040 [0034.596] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 0 [0034.596] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0034.596] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 1 [0034.597] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 0xffffffff [0034.597] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1 [0034.597] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 0x20 [0034.597] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.598] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.598] ReadFile (in: hFile=0x108, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x4ea, lpOverlapped=0x0) returned 1 [0034.600] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x4ea, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x4ea, lpOverlapped=0x0) returned 1 [0034.601] ReadFile (in: hFile=0x108, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.601] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.601] CloseHandle (hObject=0x108) returned 1 [0034.601] CloseHandle (hObject=0x100) returned 1 [0034.601] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.crypt")) returned 0 [0034.601] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.crypt")) returned 0x20 [0034.601] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Magnify.lnk", cAlternateFileName="")) returned 0x5c9040 [0034.601] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Magnify.lnk", cAlternateFileName="")) returned 0 [0034.601] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0034.601] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 1 [0034.602] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 0xffffffff [0034.602] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1 [0034.602] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 0x20 [0034.603] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.603] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.604] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x4ee, lpOverlapped=0x0) returned 1 [0034.605] WriteFile (in: hFile=0x108, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x4ee, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x4ee, lpOverlapped=0x0) returned 1 [0034.606] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.606] WriteFile (in: hFile=0x108, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.606] CloseHandle (hObject=0x100) returned 1 [0034.606] CloseHandle (hObject=0x108) returned 1 [0034.606] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.crypt")) returned 0 [0034.607] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.crypt")) returned 0x20 [0034.607] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Narrator.lnk", cAlternateFileName="")) returned 0x5c9040 [0034.607] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Narrator.lnk", cAlternateFileName="")) returned 0 [0034.607] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0034.607] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 1 [0034.608] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 0xffffffff [0034.608] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 1 [0034.608] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 0x20 [0034.608] VirtualAlloc (lpAddress=0x31a4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31a4000 [0034.609] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.609] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.610] ReadFile (in: hFile=0x108, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x4e2, lpOverlapped=0x0) returned 1 [0034.611] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x4e2, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x4e2, lpOverlapped=0x0) returned 1 [0034.612] ReadFile (in: hFile=0x108, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.612] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.612] CloseHandle (hObject=0x108) returned 1 [0034.612] CloseHandle (hObject=0x100) returned 1 [0034.612] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.crypt")) returned 0 [0034.612] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.crypt")) returned 0x20 [0034.613] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0x5c9040 [0034.613] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0034.613] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0034.613] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 1 [0034.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 0xffffffff [0034.614] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0034.614] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0034.614] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 1 [0034.614] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 0x20 [0034.614] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.615] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.615] ReadFile (in: hFile=0x114, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x500, lpOverlapped=0x0) returned 1 [0034.617] WriteFile (in: hFile=0x100, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x500, lpOverlapped=0x0) returned 1 [0034.618] ReadFile (in: hFile=0x114, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.618] WriteFile (in: hFile=0x100, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.618] CloseHandle (hObject=0x114) returned 1 [0034.618] CloseHandle (hObject=0x100) returned 1 [0034.618] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.crypt")) returned 0 [0034.618] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.crypt")) returned 0x20 [0034.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 0x5c9000 [0034.618] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 0 [0034.618] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0034.618] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 1 [0034.619] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 0xffffffff [0034.619] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0034.619] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0x26 [0034.619] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.620] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x2a6, lpOverlapped=0x0) returned 1 [0034.621] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x2a6, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x2a6, lpOverlapped=0x0) returned 1 [0034.622] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.622] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.622] CloseHandle (hObject=0x100) returned 1 [0034.622] CloseHandle (hObject=0x114) returned 1 [0034.622] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypt")) returned 0 [0034.622] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypt")) returned 0x20 [0034.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0034.623] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0034.623] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0034.623] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 1 [0034.623] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0xffffffff [0034.624] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1 [0034.624] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 0x20 [0034.625] VirtualAlloc (lpAddress=0x31a8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31a8000 [0034.625] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.626] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.626] ReadFile (in: hFile=0x114, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x518, lpOverlapped=0x0) returned 1 [0034.628] WriteFile (in: hFile=0x100, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x518, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x518, lpOverlapped=0x0) returned 1 [0034.629] ReadFile (in: hFile=0x114, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.629] WriteFile (in: hFile=0x100, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.629] CloseHandle (hObject=0x114) returned 1 [0034.629] CloseHandle (hObject=0x100) returned 1 [0034.629] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.crypt")) returned 0 [0034.629] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.crypt")) returned 0x20 [0034.629] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0x5c9000 [0034.629] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0 [0034.629] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0034.629] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 1 [0034.631] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 0xffffffff [0034.631] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="Run.lnk", cAlternateFileName="")) returned 1 [0034.631] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 0x20 [0034.631] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.632] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.633] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x106, lpOverlapped=0x0) returned 1 [0034.634] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x106, lpOverlapped=0x0) returned 1 [0034.634] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.634] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.634] CloseHandle (hObject=0x100) returned 1 [0034.634] CloseHandle (hObject=0x114) returned 1 [0034.635] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.crypt")) returned 0 [0034.635] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.crypt")) returned 0x20 [0034.635] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Run.lnk", cAlternateFileName="")) returned 0x5c9000 [0034.635] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Run.lnk", cAlternateFileName="")) returned 0 [0034.635] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0034.635] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 1 [0034.636] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 0xffffffff [0034.636] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0034.636] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xce, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0034.636] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xce, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.637] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0xce, dwReserved1=0x0, cFileName="computer.lnk", cAlternateFileName="")) returned 1 [0034.637] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 0x20 [0034.638] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.638] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.639] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x106, lpOverlapped=0x0) returned 1 [0034.640] WriteFile (in: hFile=0x108, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x106, lpOverlapped=0x0) returned 1 [0034.646] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.646] WriteFile (in: hFile=0x108, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.646] CloseHandle (hObject=0x100) returned 1 [0034.646] CloseHandle (hObject=0x108) returned 1 [0034.646] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.crypt")) returned 0 [0034.647] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.crypt")) returned 0x20 [0034.647] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="computer.lnk", cAlternateFileName="")) returned 0x5c9040 [0034.647] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="computer.lnk", cAlternateFileName="")) returned 0 [0034.647] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0034.647] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 1 [0034.648] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 0xffffffff [0034.648] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 1 [0034.648] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 0x20 [0034.649] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.649] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.650] ReadFile (in: hFile=0x108, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x106, lpOverlapped=0x0) returned 1 [0034.651] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x106, lpOverlapped=0x0) returned 1 [0034.652] ReadFile (in: hFile=0x108, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.652] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.652] CloseHandle (hObject=0x108) returned 1 [0034.652] CloseHandle (hObject=0x100) returned 1 [0034.652] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.crypt")) returned 0 [0034.652] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.crypt")) returned 0x20 [0034.652] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 0x5c9040 [0034.653] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 0 [0034.653] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0034.653] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 1 [0034.654] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 0xffffffff [0034.654] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0034.654] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 0x6 [0034.654] VirtualAlloc (lpAddress=0x31ac000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31ac000 [0034.654] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.654] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.655] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2e2, lpOverlapped=0x0) returned 1 [0034.656] WriteFile (in: hFile=0x108, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2e2, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2e2, lpOverlapped=0x0) returned 1 [0034.657] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.658] WriteFile (in: hFile=0x108, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.658] CloseHandle (hObject=0x100) returned 1 [0034.658] CloseHandle (hObject=0x108) returned 1 [0034.658] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.crypt")) returned 0 [0034.658] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.crypt")) returned 0x20 [0034.658] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c9040 [0034.658] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0034.658] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0034.658] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 1 [0034.659] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 0xffffffff [0034.660] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5df, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0034.660] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 0x20 [0034.660] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.662] ReadFile (in: hFile=0x108, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x5df, lpOverlapped=0x0) returned 1 [0034.663] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x5df, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x5df, lpOverlapped=0x0) returned 1 [0034.664] ReadFile (in: hFile=0x108, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.664] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.664] CloseHandle (hObject=0x108) returned 1 [0034.664] CloseHandle (hObject=0x100) returned 1 [0034.664] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.crypt")) returned 0 [0034.664] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.crypt")) returned 0x20 [0034.664] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5df, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x5c9040 [0034.665] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5df, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0034.665] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0034.665] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 1 [0034.666] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 0xffffffff [0034.666] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 1 [0034.666] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 0x20 [0034.666] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0034.666] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.667] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x51a, lpOverlapped=0x0) returned 1 [0034.668] WriteFile (in: hFile=0x108, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x51a, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x51a, lpOverlapped=0x0) returned 1 [0034.669] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.669] WriteFile (in: hFile=0x108, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0034.669] CloseHandle (hObject=0x100) returned 1 [0034.670] CloseHandle (hObject=0x108) returned 1 [0034.670] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.crypt")) returned 0 [0034.670] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.crypt")) returned 0x20 [0034.670] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0x5c9040 [0034.670] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0 [0034.670] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0034.670] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 1 [0034.671] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 0xffffffff [0034.671] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0 [0034.672] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0034.672] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0034.672] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 0x20 [0034.673] VirtualAlloc (lpAddress=0x31b0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31b0000 [0034.673] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.673] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.676] ReadFile (in: hFile=0x114, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x4cc, lpOverlapped=0x0) returned 1 [0034.678] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x4cc, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x4cc, lpOverlapped=0x0) returned 1 [0034.679] ReadFile (in: hFile=0x114, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.679] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.679] CloseHandle (hObject=0x114) returned 1 [0034.679] CloseHandle (hObject=0x108) returned 1 [0034.679] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.crypt")) returned 0 [0034.679] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.crypt")) returned 0x20 [0034.679] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x5c9000 [0034.679] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0034.679] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0034.679] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 1 [0034.680] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 0xffffffff [0034.680] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0034.680] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0034.680] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f6c, dwReserved1=0x6e6c2e72, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0034.680] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0034.680] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="..", cAlternateFileName="")) returned 1 [0034.680] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.680] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 0x6 [0034.681] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.681] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.682] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0xae, lpOverlapped=0x0) returned 1 [0034.682] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0xae, lpOverlapped=0x0) returned 1 [0034.683] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.683] WriteFile (in: hFile=0x114, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.683] CloseHandle (hObject=0x108) returned 1 [0034.683] CloseHandle (hObject=0x114) returned 1 [0034.683] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypt")) returned 0 [0034.684] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypt")) returned 0x20 [0034.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0034.684] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.684] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0034.684] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 1 [0034.685] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 0xffffffff [0034.685] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.685] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0034.685] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x65726f6c, dwReserved1=0x6e6c2e72, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.685] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 0x6 [0034.685] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.685] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.686] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x1dc, lpOverlapped=0x0) returned 1 [0034.687] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x1dc, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x1dc, lpOverlapped=0x0) returned 1 [0034.688] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0034.688] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0034.688] CloseHandle (hObject=0x104) returned 1 [0034.688] CloseHandle (hObject=0x114) returned 1 [0034.688] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypt")) returned 0 [0034.688] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypt")) returned 0x20 [0034.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8fc0 [0034.688] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.688] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0034.688] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 1 [0034.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 0xffffffff [0034.689] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x5c8d98, dwReserved1=0x18ea04, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0034.689] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 0x20 [0034.690] VirtualAlloc (lpAddress=0x31b4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31b4000 [0034.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.691] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x58b, lpOverlapped=0x0) returned 1 [0034.693] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x58b, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x58b, lpOverlapped=0x0) returned 1 [0034.694] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0034.694] WriteFile (in: hFile=0x104, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0034.694] CloseHandle (hObject=0x114) returned 1 [0034.694] CloseHandle (hObject=0x104) returned 1 [0034.694] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.crypt")) returned 0 [0034.694] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.crypt")) returned 0x20 [0034.694] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0x5c8fc0 [0034.694] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0 [0034.694] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0034.694] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 1 [0034.695] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 0xffffffff [0034.695] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0034.695] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 0x20 [0034.696] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.696] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.697] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x5ad, lpOverlapped=0x0) returned 1 [0034.698] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x5ad, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x5ad, lpOverlapped=0x0) returned 1 [0034.699] ReadFile (in: hFile=0x104, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0034.700] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0034.700] CloseHandle (hObject=0x104) returned 1 [0034.700] CloseHandle (hObject=0x114) returned 1 [0034.700] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.crypt")) returned 0 [0034.700] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.crypt")) returned 0x20 [0034.700] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x5c8fc0 [0034.700] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0034.700] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0034.700] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 1 [0034.701] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 0xffffffff [0034.701] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0034.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0034.701] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.701] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0xd2, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0034.701] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0x26 [0034.702] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.702] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.702] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x13e, lpOverlapped=0x0) returned 1 [0034.704] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x13e, lpOverlapped=0x0) returned 1 [0034.705] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.705] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.705] CloseHandle (hObject=0x104) returned 1 [0034.705] CloseHandle (hObject=0x108) returned 1 [0034.705] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypt")) returned 0 [0034.705] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypt")) returned 0x20 [0034.705] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0034.706] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0034.706] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0034.706] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 1 [0034.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0xffffffff [0034.707] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="Help.lnk", cAlternateFileName="")) returned 1 [0034.707] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 0x20 [0034.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.709] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x106, lpOverlapped=0x0) returned 1 [0034.710] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x106, lpOverlapped=0x0) returned 1 [0034.710] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.710] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.710] CloseHandle (hObject=0x108) returned 1 [0034.711] CloseHandle (hObject=0x104) returned 1 [0034.711] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.crypt")) returned 0 [0034.711] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.crypt")) returned 0x20 [0034.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Help.lnk", cAlternateFileName="")) returned 0x5c9000 [0034.711] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Help.lnk", cAlternateFileName="")) returned 0 [0034.711] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0034.711] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 1 [0034.712] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 0xffffffff [0034.712] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="Help.lnk", cAlternateFileName="")) returned 0 [0034.712] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0034.713] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Startup", cAlternateFileName="")) returned 1 [0034.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0034.713] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="..", cAlternateFileName="")) returned 1 [0034.713] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.713] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 0x6 [0034.713] VirtualAlloc (lpAddress=0x31b8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31b8000 [0034.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0034.714] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.715] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0xae, lpOverlapped=0x0) returned 1 [0034.715] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0xae, lpOverlapped=0x0) returned 1 [0034.716] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.716] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0034.716] CloseHandle (hObject=0x104) returned 1 [0034.716] CloseHandle (hObject=0x108) returned 1 [0034.716] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypt")) returned 0 [0034.717] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypt")) returned 0x20 [0034.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0034.717] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.717] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0034.717] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 1 [0034.718] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 0xffffffff [0034.718] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.718] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0034.719] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Startup", cAlternateFileName="")) returned 0 [0034.719] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.719] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0034.719] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0034.719] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0034.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0034.719] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="..", cAlternateFileName="")) returned 1 [0034.719] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="..", cAlternateFileName="")) returned 0 [0034.719] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0034.719] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Themes", cAlternateFileName="")) returned 1 [0034.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0034.720] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="..", cAlternateFileName="")) returned 1 [0034.720] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd9d7d3c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 1 [0034.720] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 0x80 [0034.720] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.720] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.721] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.721] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.722] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.722] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.723] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.723] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.723] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.723] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.723] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.723] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.723] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.724] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.724] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.724] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.724] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.724] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.724] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.725] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.725] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.725] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.725] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.725] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.725] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.725] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.726] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.726] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.726] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.726] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.726] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.726] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.727] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.727] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.727] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.727] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.727] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.727] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.727] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.728] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.728] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.728] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.728] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.728] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.728] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.729] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.729] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.729] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.729] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.729] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.729] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.729] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.730] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.730] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.730] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.730] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.730] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.730] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.730] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.731] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.731] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.731] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.731] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.731] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.731] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.731] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.732] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.732] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.733] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.733] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.733] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.733] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.733] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.733] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.734] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.734] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.734] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.734] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.734] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.734] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.735] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.735] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.735] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.735] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.735] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.735] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.735] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.736] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.736] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.736] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.736] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.736] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.736] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.736] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.737] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.737] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.737] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.737] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.737] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.737] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.738] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.738] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.738] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.738] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.738] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.738] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.738] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.739] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.739] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.739] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.739] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.739] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.739] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.739] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.740] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.740] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.740] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.740] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.740] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.740] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.741] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.741] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.741] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.741] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.741] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.741] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.741] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.742] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.742] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.742] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.742] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.743] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.744] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.744] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.744] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.744] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.744] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.744] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.744] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.745] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.745] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.745] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.745] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.745] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.745] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.746] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.746] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.746] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.746] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.746] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.746] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.746] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.747] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.747] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.747] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.747] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.747] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.747] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.747] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.748] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.748] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.748] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.748] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.748] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.748] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.749] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.749] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.749] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.749] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.749] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.749] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.749] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.750] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.754] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.754] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.754] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.755] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.755] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.755] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.755] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.755] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.755] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.755] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.756] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.756] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.756] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.756] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.756] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.756] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.757] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.757] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.757] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.757] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.757] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.757] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.757] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.758] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.758] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.758] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.758] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.758] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.758] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.758] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.759] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.759] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.759] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.759] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.759] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.759] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.759] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.760] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.760] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.760] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.760] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.760] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.760] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.761] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.761] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.761] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.761] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.761] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.761] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.762] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.762] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.762] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.762] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.762] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.762] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.762] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.763] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.763] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.763] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.763] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.763] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.763] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.763] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.764] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.764] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.764] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.764] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.764] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.764] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.765] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.765] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.765] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.765] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.765] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.765] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.765] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.766] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.766] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.766] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.766] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.766] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.766] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.766] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.767] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.767] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.767] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.768] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.769] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.769] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.769] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.769] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.769] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.769] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.770] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.770] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.770] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.770] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.770] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.770] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.770] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.771] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.771] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.771] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.771] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.771] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.771] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.772] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.772] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.772] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.772] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.772] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.772] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.772] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.773] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.773] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.773] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.773] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.773] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.773] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.774] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.774] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.774] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.774] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.774] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.774] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.774] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.775] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.775] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.775] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.775] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.775] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.775] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.776] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.776] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.776] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.776] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.776] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.776] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.776] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.777] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.777] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0034.777] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xfab, lpOverlapped=0x0) returned 1 [0034.777] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xfab, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xfab, lpOverlapped=0x0) returned 1 [0034.777] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.777] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0034.777] CloseHandle (hObject=0xfc) returned 1 [0034.777] CloseHandle (hObject=0x114) returned 1 [0034.778] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.crypt")) returned 0 [0034.778] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.crypt")) returned 0x2020 [0034.778] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd9d7d3c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0x5c8f80 [0034.778] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd9d7d3c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0 [0034.778] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.778] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 1 [0034.784] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 0xffffffff [0034.784] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd9d7d3c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0 [0034.784] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0034.784] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Themes", cAlternateFileName="")) returned 0 [0034.784] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0034.784] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Word", cAlternateFileName="")) returned 1 [0034.784] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0034.812] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="..", cAlternateFileName="")) returned 1 [0034.812] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="STARTUP", cAlternateFileName="")) returned 1 [0034.812] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0034.813] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0034.813] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 0 [0034.813] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0034.813] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="STARTUP", cAlternateFileName="")) returned 0 [0034.814] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0034.814] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Word", cAlternateFileName="")) returned 0 [0034.814] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.814] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61636966, dwReserved1=0x20736574, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0034.814] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0034.814] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="..", cAlternateFileName="")) returned 1 [0034.814] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0034.814] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0034.815] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="..", cAlternateFileName="")) returned 1 [0034.815] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="..", cAlternateFileName="")) returned 0 [0034.815] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0034.815] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Firefox", cAlternateFileName="")) returned 1 [0034.815] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0034.816] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="..", cAlternateFileName="")) returned 1 [0034.816] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706c6c61, dwReserved1=0x72657061, cFileName="Crash Reports", cAlternateFileName="CRASHR~1")) returned 1 [0034.816] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0034.816] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.816] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 1 [0034.816] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 0 [0034.816] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0034.817] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33313032, dwReserved1=0x35323031, cFileName="Profiles", cAlternateFileName="")) returned 1 [0034.817] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0034.817] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.817] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0034.817] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0034.819] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.820] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb76a6d10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb76a6d10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb76a6d10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x0, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 1 [0034.820] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bookmarkbackups", cAlternateFileName="BOOKMA~1")) returned 1 [0034.820] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0034.822] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.822] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc37c9330, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc37c9330, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc37df2c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bookmarks-2017-06-05_5.json", cAlternateFileName="BOOKMA~1.JSO")) returned 1 [0034.822] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 1 [0034.822] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 0 [0034.822] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0034.823] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb47c9bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb47c9bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2d373130, dwReserved1=0x312d3630, cFileName="cert8.db", cAlternateFileName="")) returned 1 [0034.823] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2d373130, dwReserved1=0x312d3630, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 1 [0034.823] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini")) returned 0x2020 [0034.823] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.824] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xce, lpOverlapped=0x0) returned 1 [0034.825] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xce, lpOverlapped=0x0) returned 1 [0034.826] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0034.826] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0034.826] CloseHandle (hObject=0xfc) returned 1 [0034.826] CloseHandle (hObject=0x108) returned 1 [0034.826] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini.crypt")) returned 0 [0034.826] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini.crypt")) returned 0x2020 [0034.826] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 0x5c8fc0 [0034.826] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 0 [0034.826] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0034.826] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini")) returned 1 [0034.827] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\compatibility.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\compatibility.ini")) returned 0xffffffff [0034.827] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5e8ce50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5e8ce50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb639bd10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="content-prefs.sqlite", cAlternateFileName="CONTEN~1.SQL")) returned 1 [0034.827] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5ad4bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5ad4bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x83256a10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="cookies.sqlite", cAlternateFileName="COOKIE~1.SQL")) returned 1 [0034.827] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc374ed0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc374ed0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbc555e20, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="downloads.sqlite", cAlternateFileName="DOWNLO~1.SQL")) returned 1 [0034.827] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4b81e50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4b81e50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b81e50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="extensions.ini", cAlternateFileName="EXTENS~1.INI")) returned 1 [0034.827] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini")) returned 0x2020 [0034.828] VirtualAlloc (lpAddress=0x31bc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31bc000 [0034.829] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0034.829] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0034.829] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x8d, lpOverlapped=0x0) returned 1 [0034.830] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x8d, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x8d, lpOverlapped=0x0) returned 1 [0034.831] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0034.831] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0034.831] CloseHandle (hObject=0x108) returned 1 [0034.831] CloseHandle (hObject=0xfc) returned 1 [0034.831] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini.crypt")) returned 0 [0034.831] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini.crypt")) returned 0x2020 [0034.831] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4b81e50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4b81e50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b81e50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="extensions.ini", cAlternateFileName="EXTENS~1.INI")) returned 0x5c8fc0 [0034.831] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4b81e50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4b81e50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b81e50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="extensions.ini", cAlternateFileName="EXTENS~1.INI")) returned 0 [0034.831] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0034.832] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini")) returned 1 [0034.832] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\extensions.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\extensions.ini")) returned 0xffffffff [0034.832] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb45b48b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b0fa30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x70000, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="extensions.sqlite", cAlternateFileName="EXTENS~1.SQL")) returned 1 [0034.832] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="indexedDB", cAlternateFileName="INDEXE~1")) returned 1 [0034.832] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0034.833] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.833] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc, dwReserved1=0x0, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 1 [0034.833] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690069, dwReserved1=0x69006e, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0034.833] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690069, dwReserved1=0x69006e, cFileName="..", cAlternateFileName="")) returned 1 [0034.833] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690069, dwReserved1=0x69006e, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 1 [0034.834] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690069, dwReserved1=0x69006e, cFileName="idb", cAlternateFileName="")) returned 1 [0034.834] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0034.835] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.835] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="818200132aebmoouht", cAlternateFileName="818200~1")) returned 1 [0034.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740075, dwReserved1=0x68002b, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0034.836] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740075, dwReserved1=0x68002b, cFileName="..", cAlternateFileName="")) returned 1 [0034.836] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x740075, dwReserved1=0x68002b, cFileName="..", cAlternateFileName="")) returned 0 [0034.836] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0034.836] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb81a92d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 1 [0034.836] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb81a92d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 0 [0034.836] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0034.836] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x690069, dwReserved1=0x69006e, cFileName="idb", cAlternateFileName="")) returned 0 [0034.836] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0034.836] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc, dwReserved1=0x0, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 0 [0034.837] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0034.837] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4815eb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4815eb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="key3.db", cAlternateFileName="")) returned 1 [0034.837] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x850d63f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x850d63f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x850d63f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x501, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="localstore.rdf", cAlternateFileName="LOCALS~1.RDF")) returned 1 [0034.837] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="marionette.log", cAlternateFileName="MARION~1.LOG")) returned 1 [0034.837] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb50b6e70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5175550, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb5175550, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xef3, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="mimeTypes.rdf", cAlternateFileName="MIMETY~1.RDF")) returned 1 [0034.837] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="minidumps", cAlternateFileName="MINIDU~1")) returned 1 [0034.837] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0034.837] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.837] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0034.838] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0034.838] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="parent.lock", cAlternateFileName="PARENT~1.LOC")) returned 1 [0034.838] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb43eb830, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb43eb830, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3b3f6e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="permissions.sqlite", cAlternateFileName="PERMIS~1.SQL")) returned 1 [0034.838] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4c1a3d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4c1a3d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x82b58970, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa00000, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="places.sqlite", cAlternateFileName="PLACES~1.SQL")) returned 1 [0034.838] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81fbde30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81fbde30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81fbde30, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="pluginreg.dat", cAlternateFileName="PLUGIN~1.DAT")) returned 1 [0034.838] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84c85c10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x853f60d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x12069be0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0xfde, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="prefs.js", cAlternateFileName="")) returned 1 [0034.838] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4183, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="search.json", cAlternateFileName="SEARCH~1.JSO")) returned 1 [0034.838] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb477d930, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb477d930, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb47c9bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="secmod.db", cAlternateFileName="")) returned 1 [0034.838] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc3787480, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3787480, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="sessionstore.bak", cAlternateFileName="SESSIO~1.BAK")) returned 1 [0034.838] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x84e029d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x84e029d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbc5, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="sessionstore.js", cAlternateFileName="SESSIO~1.JS")) returned 1 [0034.838] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6f36850, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x50000, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="signons.sqlite", cAlternateFileName="SIGNON~1.SQL")) returned 1 [0034.838] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="times.json", cAlternateFileName="TIMES~1.JSO")) returned 1 [0034.838] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="webapps", cAlternateFileName="")) returned 1 [0034.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0034.839] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xcc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.839] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0xcc, dwReserved1=0x0, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 1 [0034.839] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0xcc, dwReserved1=0x0, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 0 [0034.839] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0034.839] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3a63b40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x2b74756e, dwReserved1=0x656d6f68, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 1 [0034.839] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3a63b40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x2b74756e, dwReserved1=0x656d6f68, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 0 [0034.839] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0034.839] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0034.839] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0034.839] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x6c756166, dwReserved1=0x35323074, cFileName="profiles.ini", cAlternateFileName="")) returned 1 [0034.839] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini")) returned 0x2020 [0034.839] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0034.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.840] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x6f, lpOverlapped=0x0) returned 1 [0034.841] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x6f, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x6f, lpOverlapped=0x0) returned 1 [0034.843] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0034.843] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0034.843] CloseHandle (hObject=0xf4) returned 1 [0034.843] CloseHandle (hObject=0x114) returned 1 [0034.843] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini.crypt")) returned 0 [0034.843] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini.crypt")) returned 0x2020 [0034.843] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="profiles.ini", cAlternateFileName="")) returned 0x5c8f40 [0034.844] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="profiles.ini", cAlternateFileName="")) returned 0 [0034.844] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0034.844] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini")) returned 1 [0034.844] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini")) returned 0xffffffff [0034.845] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x6c756166, dwReserved1=0x35323074, cFileName="profiles.ini", cAlternateFileName="")) returned 0 [0034.845] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0034.845] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x33377374, cFileName="Firefox", cAlternateFileName="")) returned 0 [0034.845] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.845] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xff907610, ftCreationTime.dwHighDateTime=0x1d4d1aa, ftLastAccessTime.dwLowDateTime=0xc235f350, ftLastAccessTime.dwHighDateTime=0x1d4cccb, ftLastWriteTime.dwLowDateTime=0xc235f350, ftLastWriteTime.dwHighDateTime=0x1d4cccb, nFileSizeHigh=0x0, nFileSizeLow=0x12b42, dwReserved0=0x61636966, dwReserved1=0x20736574, cFileName="Ni_8L4qj1FGdbSRxn.doc", cAlternateFileName="NI_8L4~1.DOC")) returned 1 [0034.845] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x762dd060, ftCreationTime.dwHighDateTime=0x1d4cd87, ftLastAccessTime.dwLowDateTime=0xbfc2ec30, ftLastAccessTime.dwHighDateTime=0x1d4c9c5, ftLastWriteTime.dwLowDateTime=0xbfc2ec30, ftLastWriteTime.dwHighDateTime=0x1d4c9c5, nFileSizeHigh=0x0, nFileSizeLow=0xbfb7, dwReserved0=0x61636966, dwReserved1=0x20736574, cFileName="OqNCxMojZn.wav", cAlternateFileName="OQNCXM~1.WAV")) returned 1 [0034.845] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a9a2190, ftCreationTime.dwHighDateTime=0x1d4d237, ftLastAccessTime.dwLowDateTime=0x471139e0, ftLastAccessTime.dwHighDateTime=0x1d4d415, ftLastWriteTime.dwLowDateTime=0x471139e0, ftLastWriteTime.dwHighDateTime=0x1d4d415, nFileSizeHigh=0x0, nFileSizeLow=0xbad9, dwReserved0=0x61636966, dwReserved1=0x20736574, cFileName="p1xYK8qxsPAik.png", cAlternateFileName="P1XYK8~1.PNG")) returned 1 [0034.845] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\p1xYK8qxsPAik.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\p1xyk8qxspaik.png")) returned 0x2020 [0034.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\p1xYK8qxsPAik.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\p1xyk8qxspaik.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\p1xYK8qxsPAik.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\p1xyk8qxspaik.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0034.846] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.846] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.847] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.847] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.848] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.848] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.848] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.848] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.848] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.848] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.849] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.849] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.849] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.849] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.849] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.849] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.849] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.850] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.850] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.850] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.850] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.850] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.850] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xad9, lpOverlapped=0x0) returned 1 [0034.851] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xad9, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xad9, lpOverlapped=0x0) returned 1 [0034.851] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0034.851] WriteFile (in: hFile=0xf0, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0034.851] CloseHandle (hObject=0xf8) returned 1 [0034.851] CloseHandle (hObject=0xf0) returned 1 [0034.851] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\p1xYK8qxsPAik.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\p1xyk8qxspaik.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\p1xYK8qxsPAik.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\p1xyk8qxspaik.png.crypt")) returned 0 [0034.851] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\p1xYK8qxsPAik.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\p1xyk8qxspaik.png.crypt")) returned 0x2020 [0034.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\p1xYK8qxsPAik.png", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a9a2190, ftCreationTime.dwHighDateTime=0x1d4d237, ftLastAccessTime.dwLowDateTime=0x471139e0, ftLastAccessTime.dwHighDateTime=0x1d4d415, ftLastWriteTime.dwLowDateTime=0x471139e0, ftLastWriteTime.dwHighDateTime=0x1d4d415, nFileSizeHigh=0x0, nFileSizeLow=0xbad9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="p1xYK8qxsPAik.png", cAlternateFileName="P1XYK8~1.PNG")) returned 0x5c8ec0 [0034.851] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a9a2190, ftCreationTime.dwHighDateTime=0x1d4d237, ftLastAccessTime.dwLowDateTime=0x471139e0, ftLastAccessTime.dwHighDateTime=0x1d4d415, ftLastWriteTime.dwLowDateTime=0x471139e0, ftLastWriteTime.dwHighDateTime=0x1d4d415, nFileSizeHigh=0x0, nFileSizeLow=0xbad9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="p1xYK8qxsPAik.png", cAlternateFileName="P1XYK8~1.PNG")) returned 0 [0034.851] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.851] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\p1xYK8qxsPAik.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\p1xyk8qxspaik.png")) returned 1 [0034.853] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\p1xYK8qxsPAik.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\p1xyk8qxspaik.png")) returned 0xffffffff [0034.853] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf68f2650, ftCreationTime.dwHighDateTime=0x1d4d57a, ftLastAccessTime.dwLowDateTime=0xf5244d70, ftLastAccessTime.dwHighDateTime=0x1d4ceb0, ftLastWriteTime.dwLowDateTime=0xf5244d70, ftLastWriteTime.dwHighDateTime=0x1d4ceb0, nFileSizeHigh=0x0, nFileSizeLow=0x97e2, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="pQCAO97rkdmRwj9NW3o3.mp3", cAlternateFileName="PQCAO9~1.MP3")) returned 1 [0034.853] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb38f1600, ftCreationTime.dwHighDateTime=0x1d4d2cb, ftLastAccessTime.dwLowDateTime=0xb9a74170, ftLastAccessTime.dwHighDateTime=0x1d4d38e, ftLastWriteTime.dwLowDateTime=0xb9a74170, ftLastWriteTime.dwHighDateTime=0x1d4d38e, nFileSizeHigh=0x0, nFileSizeLow=0xe073, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="q86puH0YQ-mt7kuzPfbX.mp3", cAlternateFileName="Q86PUH~1.MP3")) returned 1 [0034.853] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x185ab970, ftCreationTime.dwHighDateTime=0x1d4d517, ftLastAccessTime.dwLowDateTime=0xae8211e0, ftLastAccessTime.dwHighDateTime=0x1d4cc8a, ftLastWriteTime.dwLowDateTime=0xae8211e0, ftLastWriteTime.dwHighDateTime=0x1d4cc8a, nFileSizeHigh=0x0, nFileSizeLow=0x1049, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="qeupIUL.bmp", cAlternateFileName="")) returned 1 [0034.853] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64a373d0, ftCreationTime.dwHighDateTime=0x1d4cc84, ftLastAccessTime.dwLowDateTime=0x188b8a80, ftLastAccessTime.dwHighDateTime=0x1d4d203, ftLastWriteTime.dwLowDateTime=0x188b8a80, ftLastWriteTime.dwHighDateTime=0x1d4d203, nFileSizeHigh=0x0, nFileSizeLow=0xbc9b, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="qGPw_iyO.mp4", cAlternateFileName="")) returned 1 [0034.853] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1af6d920, ftCreationTime.dwHighDateTime=0x1d4cbf8, ftLastAccessTime.dwLowDateTime=0x6fa24d00, ftLastAccessTime.dwHighDateTime=0x1d4d293, ftLastWriteTime.dwLowDateTime=0x6fa24d00, ftLastWriteTime.dwHighDateTime=0x1d4d293, nFileSizeHigh=0x0, nFileSizeLow=0x9b6c, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="RMAlosi.rtf", cAlternateFileName="")) returned 1 [0034.853] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1f06a80, ftCreationTime.dwHighDateTime=0x1d4c87a, ftLastAccessTime.dwLowDateTime=0xb3d19d80, ftLastAccessTime.dwHighDateTime=0x1d4c868, ftLastWriteTime.dwLowDateTime=0xb3d19d80, ftLastWriteTime.dwHighDateTime=0x1d4c868, nFileSizeHigh=0x0, nFileSizeLow=0x5565, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Tl3qril8wkR9FIs6HZ.swf", cAlternateFileName="TL3QRI~1.SWF")) returned 1 [0034.853] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ed7d440, ftCreationTime.dwHighDateTime=0x1d4c921, ftLastAccessTime.dwLowDateTime=0x5343c2d0, ftLastAccessTime.dwHighDateTime=0x1d4d039, ftLastWriteTime.dwLowDateTime=0x5343c2d0, ftLastWriteTime.dwHighDateTime=0x1d4d039, nFileSizeHigh=0x0, nFileSizeLow=0x64da, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="vzim190EpBWG_TJXvP.m4a", cAlternateFileName="VZIM19~1.M4A")) returned 1 [0034.853] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4818080, ftCreationTime.dwHighDateTime=0x1d4ce92, ftLastAccessTime.dwLowDateTime=0xa784e4c0, ftLastAccessTime.dwHighDateTime=0x1d4d145, ftLastWriteTime.dwLowDateTime=0xa784e4c0, ftLastWriteTime.dwHighDateTime=0x1d4d145, nFileSizeHigh=0x0, nFileSizeLow=0x2165, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Wp7LOk.m4a", cAlternateFileName="")) returned 1 [0034.853] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c15c810, ftCreationTime.dwHighDateTime=0x1d4c8c7, ftLastAccessTime.dwLowDateTime=0xe9444c20, ftLastAccessTime.dwHighDateTime=0x1d4cb4b, ftLastWriteTime.dwLowDateTime=0xe9444c20, ftLastWriteTime.dwHighDateTime=0x1d4cb4b, nFileSizeHigh=0x0, nFileSizeLow=0x353b, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="XJHuolq7G.swf", cAlternateFileName="XJHUOL~1.SWF")) returned 1 [0034.853] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f01c560, ftCreationTime.dwHighDateTime=0x1d4c7d2, ftLastAccessTime.dwLowDateTime=0x581cdb70, ftLastAccessTime.dwHighDateTime=0x1d4cb52, ftLastWriteTime.dwLowDateTime=0x581cdb70, ftLastWriteTime.dwHighDateTime=0x1d4cb52, nFileSizeHigh=0x0, nFileSizeLow=0x12c67, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="XU7TpXHMTpi3hxEYx5.png", cAlternateFileName="XU7TPX~1.PNG")) returned 1 [0034.853] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XU7TpXHMTpi3hxEYx5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xu7tpxhmtpi3hxeyx5.png")) returned 0x2020 [0034.854] VirtualAlloc (lpAddress=0x31c0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31c0000 [0034.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XU7TpXHMTpi3hxEYx5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xu7tpxhmtpi3hxeyx5.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0034.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XU7TpXHMTpi3hxEYx5.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xu7tpxhmtpi3hxeyx5.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.854] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.855] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.856] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.856] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.856] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.857] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.857] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.857] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.857] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.857] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.857] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.857] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.858] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.858] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.858] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.858] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.858] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.858] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.858] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.859] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.859] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.859] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.859] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.859] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.859] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.860] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.860] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.860] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.860] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.860] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.860] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.860] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.861] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.861] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.861] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.861] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0034.861] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xc67, lpOverlapped=0x0) returned 1 [0034.861] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xc67, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xc67, lpOverlapped=0x0) returned 1 [0034.861] ReadFile (in: hFile=0xf0, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0034.861] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0034.862] CloseHandle (hObject=0xf0) returned 1 [0034.862] CloseHandle (hObject=0xf8) returned 1 [0034.862] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XU7TpXHMTpi3hxEYx5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xu7tpxhmtpi3hxeyx5.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XU7TpXHMTpi3hxEYx5.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xu7tpxhmtpi3hxeyx5.png.crypt")) returned 0 [0034.862] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XU7TpXHMTpi3hxEYx5.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xu7tpxhmtpi3hxeyx5.png.crypt")) returned 0x2020 [0034.862] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XU7TpXHMTpi3hxEYx5.png", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f01c560, ftCreationTime.dwHighDateTime=0x1d4c7d2, ftLastAccessTime.dwLowDateTime=0x581cdb70, ftLastAccessTime.dwHighDateTime=0x1d4cb52, ftLastWriteTime.dwLowDateTime=0x581cdb70, ftLastWriteTime.dwHighDateTime=0x1d4cb52, nFileSizeHigh=0x0, nFileSizeLow=0x12c67, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="XU7TpXHMTpi3hxEYx5.png", cAlternateFileName="XU7TPX~1.PNG")) returned 0x5c8ec0 [0034.862] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f01c560, ftCreationTime.dwHighDateTime=0x1d4c7d2, ftLastAccessTime.dwLowDateTime=0x581cdb70, ftLastAccessTime.dwHighDateTime=0x1d4cb52, ftLastWriteTime.dwLowDateTime=0x581cdb70, ftLastWriteTime.dwHighDateTime=0x1d4cb52, nFileSizeHigh=0x0, nFileSizeLow=0x12c67, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="XU7TpXHMTpi3hxEYx5.png", cAlternateFileName="XU7TPX~1.PNG")) returned 0 [0034.862] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.862] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XU7TpXHMTpi3hxEYx5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xu7tpxhmtpi3hxeyx5.png")) returned 1 [0034.864] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XU7TpXHMTpi3hxEYx5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xu7tpxhmtpi3hxeyx5.png")) returned 0xffffffff [0034.864] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f01c560, ftCreationTime.dwHighDateTime=0x1d4c7d2, ftLastAccessTime.dwLowDateTime=0x581cdb70, ftLastAccessTime.dwHighDateTime=0x1d4cb52, ftLastWriteTime.dwLowDateTime=0x581cdb70, ftLastWriteTime.dwHighDateTime=0x1d4cb52, nFileSizeHigh=0x0, nFileSizeLow=0x12c67, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="XU7TpXHMTpi3hxEYx5.png", cAlternateFileName="XU7TPX~1.PNG")) returned 0 [0034.864] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0034.864] FindNextFileA (in: hFindFile=0x5c5d58, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x951cc660, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x951cc660, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="")) returned 0 [0034.864] FindClose (in: hFindFile=0x5c5d58 | out: hFindFile=0x5c5d58) returned 1 [0034.864] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x20b87e0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0034.864] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x951cc660, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x951cc660, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="\xb0\x4c\x5c")) returned 0xffffffff [0034.864] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x20b87e0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0034.864] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45786833, dwReserved1=0x2e357859, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0034.864] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45786833, dwReserved1=0x2e357859, cFileName="..", cAlternateFileName="")) returned 1 [0034.864] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x45786833, dwReserved1=0x2e357859, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0034.864] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x45786833, dwReserved1=0x2e357859, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0034.864] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x45786833, dwReserved1=0x2e357859, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0034.864] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x45786833, dwReserved1=0x2e357859, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0034.864] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x45786833, dwReserved1=0x2e357859, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.865] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini")) returned 0x26 [0034.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.865] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.865] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x19c, lpOverlapped=0x0) returned 1 [0034.866] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x19c, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x19c, lpOverlapped=0x0) returned 1 [0034.867] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.867] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.867] CloseHandle (hObject=0xec) returned 1 [0034.867] CloseHandle (hObject=0xf8) returned 1 [0034.867] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini.crypt")) returned 0 [0034.867] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini.crypt")) returned 0x20 [0034.867] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0034.868] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.868] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.868] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini")) returned 1 [0034.868] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\desktop.ini")) returned 0xffffffff [0034.868] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0034.869] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0034.869] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0034.869] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0034.869] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Cookies", cAlternateFileName="")) returned 1 [0034.869] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="sikvnb huvuib.contact", cAlternateFileName="\xb0\x4c\x5c")) returned 0xffffffff [0034.869] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9c2b7a00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9c2b7a00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Desktop", cAlternateFileName="")) returned 1 [0034.869] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9c2b7a00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9c2b7a00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0034.869] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9c2b7a00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9c2b7a00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0034.869] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14160f0, ftCreationTime.dwHighDateTime=0x1d4c777, ftLastAccessTime.dwLowDateTime=0xaac5b9d0, ftLastAccessTime.dwHighDateTime=0x1d4d1f3, ftLastWriteTime.dwLowDateTime=0xaac5b9d0, ftLastWriteTime.dwHighDateTime=0x1d4d1f3, nFileSizeHigh=0x0, nFileSizeLow=0xde72, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="-1ZO0EqDkBVCp64.m4a", cAlternateFileName="-1ZO0E~1.M4A")) returned 1 [0034.869] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83561fe0, ftCreationTime.dwHighDateTime=0x1d4c93b, ftLastAccessTime.dwLowDateTime=0xef1da010, ftLastAccessTime.dwHighDateTime=0x1d4cd9e, ftLastWriteTime.dwLowDateTime=0xef1da010, ftLastWriteTime.dwHighDateTime=0x1d4cd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9fa, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="20w83dwa.png", cAlternateFileName="")) returned 1 [0034.869] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\20w83dwa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\20w83dwa.png")) returned 0x20 [0034.869] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\20w83dwa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\20w83dwa.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.869] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\20w83dwa.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\20w83dwa.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.870] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.870] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.871] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.871] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.871] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.872] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.872] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.872] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.872] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.872] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.872] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.872] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.873] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.873] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.873] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.873] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.873] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.873] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.873] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.874] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.874] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.874] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.874] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.874] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.874] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.874] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.875] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x9fa, lpOverlapped=0x0) returned 1 [0034.875] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x9fa, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x9fa, lpOverlapped=0x0) returned 1 [0034.875] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.875] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.875] CloseHandle (hObject=0xf8) returned 1 [0034.875] CloseHandle (hObject=0xec) returned 1 [0034.875] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\20w83dwa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\20w83dwa.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\20w83dwa.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\20w83dwa.png.crypt")) returned 0 [0034.876] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\20w83dwa.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\20w83dwa.png.crypt")) returned 0x20 [0034.876] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\20w83dwa.png", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83561fe0, ftCreationTime.dwHighDateTime=0x1d4c93b, ftLastAccessTime.dwLowDateTime=0xef1da010, ftLastAccessTime.dwHighDateTime=0x1d4cd9e, ftLastWriteTime.dwLowDateTime=0xef1da010, ftLastWriteTime.dwHighDateTime=0x1d4cd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9fa, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="20w83dwa.png", cAlternateFileName="")) returned 0x5c8ec0 [0034.876] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83561fe0, ftCreationTime.dwHighDateTime=0x1d4c93b, ftLastAccessTime.dwLowDateTime=0xef1da010, ftLastAccessTime.dwHighDateTime=0x1d4cd9e, ftLastWriteTime.dwLowDateTime=0xef1da010, ftLastWriteTime.dwHighDateTime=0x1d4cd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9fa, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="20w83dwa.png", cAlternateFileName="")) returned 0 [0034.876] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.876] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\20w83dwa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\20w83dwa.png")) returned 1 [0034.878] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\20w83dwa.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\20w83dwa.png")) returned 0xffffffff [0034.878] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd328fca0, ftCreationTime.dwHighDateTime=0x1d4d2d6, ftLastAccessTime.dwLowDateTime=0x7dfaa9d0, ftLastAccessTime.dwHighDateTime=0x1d4d462, ftLastWriteTime.dwLowDateTime=0x7dfaa9d0, ftLastWriteTime.dwHighDateTime=0x1d4d462, nFileSizeHigh=0x0, nFileSizeLow=0xefb0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="6ze-zapzBvRslmR3.mp3", cAlternateFileName="6ZE-ZA~1.MP3")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20730620, ftCreationTime.dwHighDateTime=0x1d4c7ee, ftLastAccessTime.dwLowDateTime=0x37b67a80, ftLastAccessTime.dwHighDateTime=0x1d4d4b2, ftLastWriteTime.dwLowDateTime=0x37b67a80, ftLastWriteTime.dwHighDateTime=0x1d4d4b2, nFileSizeHigh=0x0, nFileSizeLow=0xa039, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="7r-1o.ods", cAlternateFileName="")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdef830, ftCreationTime.dwHighDateTime=0x1d4c7c6, ftLastAccessTime.dwLowDateTime=0x125e680, ftLastAccessTime.dwHighDateTime=0x1d4c810, ftLastWriteTime.dwLowDateTime=0x125e680, ftLastWriteTime.dwHighDateTime=0x1d4c810, nFileSizeHigh=0x0, nFileSizeLow=0xfb6d, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="a zSKVxRNzq.gif", cAlternateFileName="AZSKVX~1.GIF")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809b9ec0, ftCreationTime.dwHighDateTime=0x1d4cda4, ftLastAccessTime.dwLowDateTime=0x33a3edc0, ftLastAccessTime.dwHighDateTime=0x1d4c633, ftLastWriteTime.dwLowDateTime=0x33a3edc0, ftLastWriteTime.dwHighDateTime=0x1d4c633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="b ylBYEH0cothr-", cAlternateFileName="BYLBYE~1")) returned 1 [0034.878] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809b9ec0, ftCreationTime.dwHighDateTime=0x1d4cda4, ftLastAccessTime.dwLowDateTime=0x33a3edc0, ftLastAccessTime.dwHighDateTime=0x1d4c633, ftLastWriteTime.dwLowDateTime=0x33a3edc0, ftLastWriteTime.dwHighDateTime=0x1d4c633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0034.878] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809b9ec0, ftCreationTime.dwHighDateTime=0x1d4cda4, ftLastAccessTime.dwLowDateTime=0x33a3edc0, ftLastAccessTime.dwHighDateTime=0x1d4c633, ftLastWriteTime.dwLowDateTime=0x33a3edc0, ftLastWriteTime.dwHighDateTime=0x1d4c633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce6f3f0, ftCreationTime.dwHighDateTime=0x1d4cc46, ftLastAccessTime.dwLowDateTime=0x3a371f70, ftLastAccessTime.dwHighDateTime=0x1d4c810, ftLastWriteTime.dwLowDateTime=0x3a371f70, ftLastWriteTime.dwHighDateTime=0x1d4c810, nFileSizeHigh=0x0, nFileSizeLow=0x13ac2, dwReserved0=0x64, dwReserved1=0x0, cFileName="A1O_.wav", cAlternateFileName="")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf421e6f0, ftCreationTime.dwHighDateTime=0x1d4c6c0, ftLastAccessTime.dwLowDateTime=0xcd34e4e0, ftLastAccessTime.dwHighDateTime=0x1d4cfab, ftLastWriteTime.dwLowDateTime=0xcd34e4e0, ftLastWriteTime.dwHighDateTime=0x1d4cfab, nFileSizeHigh=0x0, nFileSizeLow=0xc819, dwReserved0=0x64, dwReserved1=0x0, cFileName="B320plYDi698XfAex.bmp", cAlternateFileName="B320PL~1.BMP")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9e5bda0, ftCreationTime.dwHighDateTime=0x1d4cd86, ftLastAccessTime.dwLowDateTime=0xbb2edc40, ftLastAccessTime.dwHighDateTime=0x1d4c8a0, ftLastWriteTime.dwLowDateTime=0xbb2edc40, ftLastWriteTime.dwHighDateTime=0x1d4c8a0, nFileSizeHigh=0x0, nFileSizeLow=0x12a52, dwReserved0=0x64, dwReserved1=0x0, cFileName="GE7lIEhlHt2sIB.mp3", cAlternateFileName="GE7LIE~1.MP3")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2950e170, ftCreationTime.dwHighDateTime=0x1d4c8d6, ftLastAccessTime.dwLowDateTime=0xddf67e10, ftLastAccessTime.dwHighDateTime=0x1d4c7f9, ftLastWriteTime.dwLowDateTime=0xddf67e10, ftLastWriteTime.dwHighDateTime=0x1d4c7f9, nFileSizeHigh=0x0, nFileSizeLow=0x7766, dwReserved0=0x64, dwReserved1=0x0, cFileName="JAveQ8Yg3Bf8zCjLZ.flv", cAlternateFileName="JAVEQ8~1.FLV")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddf27250, ftCreationTime.dwHighDateTime=0x1d4d1b0, ftLastAccessTime.dwLowDateTime=0x8d9cdfc0, ftLastAccessTime.dwHighDateTime=0x1d4c80f, ftLastWriteTime.dwLowDateTime=0x8d9cdfc0, ftLastWriteTime.dwHighDateTime=0x1d4c80f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64, dwReserved1=0x0, cFileName="MuwQtWu1bqcJz_nr_4", cAlternateFileName="MUWQTW~1")) returned 1 [0034.878] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\MuwQtWu1bqcJz_nr_4\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddf27250, ftCreationTime.dwHighDateTime=0x1d4d1b0, ftLastAccessTime.dwLowDateTime=0x8d9cdfc0, ftLastAccessTime.dwHighDateTime=0x1d4c80f, ftLastWriteTime.dwLowDateTime=0x8d9cdfc0, ftLastWriteTime.dwHighDateTime=0x1d4c80f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa7b579bf, dwReserved1=0x41382ca1, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0034.878] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddf27250, ftCreationTime.dwHighDateTime=0x1d4d1b0, ftLastAccessTime.dwLowDateTime=0x8d9cdfc0, ftLastAccessTime.dwHighDateTime=0x1d4c80f, ftLastWriteTime.dwLowDateTime=0x8d9cdfc0, ftLastWriteTime.dwHighDateTime=0x1d4c80f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa7b579bf, dwReserved1=0x41382ca1, cFileName="..", cAlternateFileName="")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22397250, ftCreationTime.dwHighDateTime=0x1d4cbe0, ftLastAccessTime.dwLowDateTime=0x7ac25b0, ftLastAccessTime.dwHighDateTime=0x1d4d0d9, ftLastWriteTime.dwLowDateTime=0x7ac25b0, ftLastWriteTime.dwHighDateTime=0x1d4d0d9, nFileSizeHigh=0x0, nFileSizeLow=0xa5f7, dwReserved0=0xa7b579bf, dwReserved1=0x41382ca1, cFileName="6c5qlTBS.gif", cAlternateFileName="")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0000df0, ftCreationTime.dwHighDateTime=0x1d4c72e, ftLastAccessTime.dwLowDateTime=0x6fb5c480, ftLastAccessTime.dwHighDateTime=0x1d4d210, ftLastWriteTime.dwLowDateTime=0x6fb5c480, ftLastWriteTime.dwHighDateTime=0x1d4d210, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0xa7b579bf, dwReserved1=0x41382ca1, cFileName="ALdqrxGRhqPLE.flv", cAlternateFileName="ALDQRX~1.FLV")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd99b420, ftCreationTime.dwHighDateTime=0x1d4c53e, ftLastAccessTime.dwLowDateTime=0xe0e4c240, ftLastAccessTime.dwHighDateTime=0x1d4ce79, ftLastWriteTime.dwLowDateTime=0xe0e4c240, ftLastWriteTime.dwHighDateTime=0x1d4ce79, nFileSizeHigh=0x0, nFileSizeLow=0x4032, dwReserved0=0xa7b579bf, dwReserved1=0x41382ca1, cFileName="AmjLNx2CmR3t6A84g.mp4", cAlternateFileName="AMJLNX~1.MP4")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86860ae0, ftCreationTime.dwHighDateTime=0x1d4d4f3, ftLastAccessTime.dwLowDateTime=0xcb546020, ftLastAccessTime.dwHighDateTime=0x1d4c55a, ftLastWriteTime.dwLowDateTime=0xcb546020, ftLastWriteTime.dwHighDateTime=0x1d4c55a, nFileSizeHigh=0x0, nFileSizeLow=0x381d, dwReserved0=0xa7b579bf, dwReserved1=0x41382ca1, cFileName="lYGVa1V.mp4", cAlternateFileName="")) returned 1 [0034.878] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42cf4370, ftCreationTime.dwHighDateTime=0x1d4c82d, ftLastAccessTime.dwLowDateTime=0x6cd0b80, ftLastAccessTime.dwHighDateTime=0x1d4d135, ftLastWriteTime.dwLowDateTime=0x6cd0b80, ftLastWriteTime.dwHighDateTime=0x1d4d135, nFileSizeHigh=0x0, nFileSizeLow=0x7276, dwReserved0=0xa7b579bf, dwReserved1=0x41382ca1, cFileName="rv__7l.pdf", cAlternateFileName="")) returned 1 [0034.879] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15194250, ftCreationTime.dwHighDateTime=0x1d4cd7d, ftLastAccessTime.dwLowDateTime=0x4366a00, ftLastAccessTime.dwHighDateTime=0x1d4d3c5, ftLastWriteTime.dwLowDateTime=0x4366a00, ftLastWriteTime.dwHighDateTime=0x1d4d3c5, nFileSizeHigh=0x0, nFileSizeLow=0x3cc1, dwReserved0=0xa7b579bf, dwReserved1=0x41382ca1, cFileName="snpq5514f5VxwNHMTa.bmp", cAlternateFileName="SNPQ55~1.BMP")) returned 1 [0034.879] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f67d40, ftCreationTime.dwHighDateTime=0x1d4cbb8, ftLastAccessTime.dwLowDateTime=0x82c09bf0, ftLastAccessTime.dwHighDateTime=0x1d4d165, ftLastWriteTime.dwLowDateTime=0x82c09bf0, ftLastWriteTime.dwHighDateTime=0x1d4d165, nFileSizeHigh=0x0, nFileSizeLow=0x2b4e, dwReserved0=0xa7b579bf, dwReserved1=0x41382ca1, cFileName="VGGDFIdk-R.gif", cAlternateFileName="VGGDFI~1.GIF")) returned 1 [0034.879] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf59df1e0, ftCreationTime.dwHighDateTime=0x1d4ce0e, ftLastAccessTime.dwLowDateTime=0x8d07a8b0, ftLastAccessTime.dwHighDateTime=0x1d4ce72, ftLastWriteTime.dwLowDateTime=0x8d07a8b0, ftLastWriteTime.dwHighDateTime=0x1d4ce72, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0xa7b579bf, dwReserved1=0x41382ca1, cFileName="x5-hMMhjBt-u0xNu.flv", cAlternateFileName="X5-HMM~1.FLV")) returned 1 [0034.879] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4e4460, ftCreationTime.dwHighDateTime=0x1d4cc50, ftLastAccessTime.dwLowDateTime=0x5ae41320, ftLastAccessTime.dwHighDateTime=0x1d4d555, ftLastWriteTime.dwLowDateTime=0x5ae41320, ftLastWriteTime.dwHighDateTime=0x1d4d555, nFileSizeHigh=0x0, nFileSizeLow=0x106f8, dwReserved0=0xa7b579bf, dwReserved1=0x41382ca1, cFileName="Y8d3EszIaEGJhzPh33x7.png", cAlternateFileName="Y8D3ES~1.PNG")) returned 1 [0034.879] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\MuwQtWu1bqcJz_nr_4\\Y8d3EszIaEGJhzPh33x7.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b ylbyeh0cothr-\\muwqtwu1bqcjz_nr_4\\y8d3esziaegjhzph33x7.png")) returned 0x20 [0034.879] VirtualAlloc (lpAddress=0x31c4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31c4000 [0034.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\MuwQtWu1bqcJz_nr_4\\Y8d3EszIaEGJhzPh33x7.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b ylbyeh0cothr-\\muwqtwu1bqcjz_nr_4\\y8d3esziaegjhzph33x7.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0034.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\MuwQtWu1bqcJz_nr_4\\Y8d3EszIaEGJhzPh33x7.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b ylbyeh0cothr-\\muwqtwu1bqcjz_nr_4\\y8d3esziaegjhzph33x7.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.879] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.880] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.881] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.881] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.881] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.882] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.882] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.882] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.882] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.882] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.882] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.882] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.883] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.883] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.883] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.883] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.883] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.883] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.883] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.884] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.884] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.884] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.884] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.884] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.884] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.885] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.885] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.885] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.885] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.885] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.885] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.885] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0034.886] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x6f8, lpOverlapped=0x0) returned 1 [0034.886] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x6f8, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x6f8, lpOverlapped=0x0) returned 1 [0034.886] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0034.886] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0034.886] CloseHandle (hObject=0xf0) returned 1 [0034.886] CloseHandle (hObject=0x114) returned 1 [0034.886] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\MuwQtWu1bqcJz_nr_4\\Y8d3EszIaEGJhzPh33x7.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b ylbyeh0cothr-\\muwqtwu1bqcjz_nr_4\\y8d3esziaegjhzph33x7.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\MuwQtWu1bqcJz_nr_4\\Y8d3EszIaEGJhzPh33x7.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b ylbyeh0cothr-\\muwqtwu1bqcjz_nr_4\\y8d3esziaegjhzph33x7.png.crypt")) returned 0 [0034.886] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\MuwQtWu1bqcJz_nr_4\\Y8d3EszIaEGJhzPh33x7.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b ylbyeh0cothr-\\muwqtwu1bqcjz_nr_4\\y8d3esziaegjhzph33x7.png.crypt")) returned 0x20 [0034.886] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\MuwQtWu1bqcJz_nr_4\\Y8d3EszIaEGJhzPh33x7.png", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4e4460, ftCreationTime.dwHighDateTime=0x1d4cc50, ftLastAccessTime.dwLowDateTime=0x5ae41320, ftLastAccessTime.dwHighDateTime=0x1d4d555, ftLastWriteTime.dwLowDateTime=0x5ae41320, ftLastWriteTime.dwHighDateTime=0x1d4d555, nFileSizeHigh=0x0, nFileSizeLow=0x106f8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Y8d3EszIaEGJhzPh33x7.png", cAlternateFileName="Y8D3ES~1.PNG")) returned 0x5c8f40 [0034.887] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4e4460, ftCreationTime.dwHighDateTime=0x1d4cc50, ftLastAccessTime.dwLowDateTime=0x5ae41320, ftLastAccessTime.dwHighDateTime=0x1d4d555, ftLastWriteTime.dwLowDateTime=0x5ae41320, ftLastWriteTime.dwHighDateTime=0x1d4d555, nFileSizeHigh=0x0, nFileSizeLow=0x106f8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Y8d3EszIaEGJhzPh33x7.png", cAlternateFileName="Y8D3ES~1.PNG")) returned 0 [0034.887] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0034.887] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\MuwQtWu1bqcJz_nr_4\\Y8d3EszIaEGJhzPh33x7.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b ylbyeh0cothr-\\muwqtwu1bqcjz_nr_4\\y8d3esziaegjhzph33x7.png")) returned 1 [0034.888] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\MuwQtWu1bqcJz_nr_4\\Y8d3EszIaEGJhzPh33x7.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b ylbyeh0cothr-\\muwqtwu1bqcjz_nr_4\\y8d3esziaegjhzph33x7.png")) returned 0xffffffff [0034.888] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f4e4460, ftCreationTime.dwHighDateTime=0x1d4cc50, ftLastAccessTime.dwLowDateTime=0x5ae41320, ftLastAccessTime.dwHighDateTime=0x1d4d555, ftLastWriteTime.dwLowDateTime=0x5ae41320, ftLastWriteTime.dwHighDateTime=0x1d4d555, nFileSizeHigh=0x0, nFileSizeLow=0x106f8, dwReserved0=0xa7b579bf, dwReserved1=0x41382ca1, cFileName="Y8d3EszIaEGJhzPh33x7.png", cAlternateFileName="Y8D3ES~1.PNG")) returned 0 [0034.888] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0034.888] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49b5a0, ftCreationTime.dwHighDateTime=0x1d4c753, ftLastAccessTime.dwLowDateTime=0x6b8631f0, ftLastAccessTime.dwHighDateTime=0x1d4c807, ftLastWriteTime.dwLowDateTime=0x6b8631f0, ftLastWriteTime.dwHighDateTime=0x1d4c807, nFileSizeHigh=0x0, nFileSizeLow=0x13fd6, dwReserved0=0x507a684a, dwReserved1=0x78333368, cFileName="nVlL.pdf", cAlternateFileName="")) returned 1 [0034.888] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63123030, ftCreationTime.dwHighDateTime=0x1d4d18c, ftLastAccessTime.dwLowDateTime=0x34f83ab0, ftLastAccessTime.dwHighDateTime=0x1d4cda8, ftLastWriteTime.dwLowDateTime=0x34f83ab0, ftLastWriteTime.dwHighDateTime=0x1d4cda8, nFileSizeHigh=0x0, nFileSizeLow=0xe841, dwReserved0=0x507a684a, dwReserved1=0x78333368, cFileName="oE_MoJA.bmp", cAlternateFileName="")) returned 1 [0034.888] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b673c10, ftCreationTime.dwHighDateTime=0x1d4ce46, ftLastAccessTime.dwLowDateTime=0x2a8a70f0, ftLastAccessTime.dwHighDateTime=0x1d4cd0a, ftLastWriteTime.dwLowDateTime=0x2a8a70f0, ftLastWriteTime.dwHighDateTime=0x1d4cd0a, nFileSizeHigh=0x0, nFileSizeLow=0x33e8, dwReserved0=0x507a684a, dwReserved1=0x78333368, cFileName="yPs6sZU6g.gif", cAlternateFileName="YPS6SZ~1.GIF")) returned 1 [0034.888] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b673c10, ftCreationTime.dwHighDateTime=0x1d4ce46, ftLastAccessTime.dwLowDateTime=0x2a8a70f0, ftLastAccessTime.dwHighDateTime=0x1d4cd0a, ftLastWriteTime.dwLowDateTime=0x2a8a70f0, ftLastWriteTime.dwHighDateTime=0x1d4cd0a, nFileSizeHigh=0x0, nFileSizeLow=0x33e8, dwReserved0=0x507a684a, dwReserved1=0x78333368, cFileName="yPs6sZU6g.gif", cAlternateFileName="YPS6SZ~1.GIF")) returned 0 [0034.889] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.889] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f59090, ftCreationTime.dwHighDateTime=0x1d4ce3e, ftLastAccessTime.dwLowDateTime=0xde842f60, ftLastAccessTime.dwHighDateTime=0x1d4d43f, ftLastWriteTime.dwLowDateTime=0xde842f60, ftLastWriteTime.dwHighDateTime=0x1d4d43f, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="cMtYEfpdkz.avi", cAlternateFileName="CMTYEF~1.AVI")) returned 1 [0034.889] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87179000, ftCreationTime.dwHighDateTime=0x1d4c80f, ftLastAccessTime.dwLowDateTime=0x647a9dc0, ftLastAccessTime.dwHighDateTime=0x1d4c5ef, ftLastWriteTime.dwLowDateTime=0x647a9dc0, ftLastWriteTime.dwHighDateTime=0x1d4c5ef, nFileSizeHigh=0x0, nFileSizeLow=0x51f1, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="cSpgQsUvdWcqqW_4G8m.xls", cAlternateFileName="CSPGQS~1.XLS")) returned 1 [0034.889] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.889] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini")) returned 0x26 [0034.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.890] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x11a, lpOverlapped=0x0) returned 1 [0034.890] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x11a, lpOverlapped=0x0) returned 1 [0034.891] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.891] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.891] CloseHandle (hObject=0xec) returned 1 [0034.891] CloseHandle (hObject=0xf8) returned 1 [0034.892] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini.crypt")) returned 0 [0034.892] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini.crypt")) returned 0x20 [0034.892] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0034.892] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.892] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.892] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini")) returned 1 [0034.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\desktop.ini")) returned 0xffffffff [0034.893] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdea96a0, ftCreationTime.dwHighDateTime=0x1d4ce8f, ftLastAccessTime.dwLowDateTime=0xe5f45b10, ftLastAccessTime.dwHighDateTime=0x1d4c5eb, ftLastWriteTime.dwLowDateTime=0xe5f45b10, ftLastWriteTime.dwHighDateTime=0x1d4c5eb, nFileSizeHigh=0x0, nFileSizeLow=0x6d6f, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="E7OPP_CKfRC.mp3", cAlternateFileName="E7OPP_~1.MP3")) returned 1 [0034.893] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd2644f0, ftCreationTime.dwHighDateTime=0x1d4cea5, ftLastAccessTime.dwLowDateTime=0xa9f2b2f0, ftLastAccessTime.dwHighDateTime=0x1d4d262, ftLastWriteTime.dwLowDateTime=0xa9f2b2f0, ftLastWriteTime.dwHighDateTime=0x1d4d262, nFileSizeHigh=0x0, nFileSizeLow=0xdad7, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="et hDjezCTkvEK.pdf", cAlternateFileName="ETHDJE~1.PDF")) returned 1 [0034.893] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb3e7d0, ftCreationTime.dwHighDateTime=0x1d4ca20, ftLastAccessTime.dwLowDateTime=0x5c73f6c0, ftLastAccessTime.dwHighDateTime=0x1d4cbe5, ftLastWriteTime.dwLowDateTime=0x5c73f6c0, ftLastWriteTime.dwHighDateTime=0x1d4cbe5, nFileSizeHigh=0x0, nFileSizeLow=0x14a5d, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="gjcKm.png", cAlternateFileName="")) returned 1 [0034.893] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gjcKm.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gjckm.png")) returned 0x20 [0034.893] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gjcKm.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gjckm.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.894] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gjcKm.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gjckm.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.894] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.894] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.895] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.895] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.895] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.896] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.896] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.896] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.896] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.896] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.896] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.896] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.897] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.897] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.897] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.897] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.897] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.897] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.897] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.898] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.898] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.898] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.898] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.898] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.898] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.898] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.898] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.899] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.899] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.899] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.899] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.899] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.899] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.899] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.900] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.900] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.900] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.900] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.900] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.900] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.900] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0xa5d, lpOverlapped=0x0) returned 1 [0034.901] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0xa5d, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0xa5d, lpOverlapped=0x0) returned 1 [0034.901] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.901] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.901] CloseHandle (hObject=0xf8) returned 1 [0034.901] CloseHandle (hObject=0xec) returned 1 [0034.901] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gjcKm.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gjckm.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gjcKm.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gjckm.png.crypt")) returned 0 [0034.901] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gjcKm.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gjckm.png.crypt")) returned 0x20 [0034.901] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gjcKm.png", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb3e7d0, ftCreationTime.dwHighDateTime=0x1d4ca20, ftLastAccessTime.dwLowDateTime=0x5c73f6c0, ftLastAccessTime.dwHighDateTime=0x1d4cbe5, ftLastWriteTime.dwLowDateTime=0x5c73f6c0, ftLastWriteTime.dwHighDateTime=0x1d4cbe5, nFileSizeHigh=0x0, nFileSizeLow=0x14a5d, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="gjcKm.png", cAlternateFileName="")) returned 0x5c8ec0 [0034.902] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb3e7d0, ftCreationTime.dwHighDateTime=0x1d4ca20, ftLastAccessTime.dwLowDateTime=0x5c73f6c0, ftLastAccessTime.dwHighDateTime=0x1d4cbe5, ftLastWriteTime.dwLowDateTime=0x5c73f6c0, ftLastWriteTime.dwHighDateTime=0x1d4cbe5, nFileSizeHigh=0x0, nFileSizeLow=0x14a5d, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="gjcKm.png", cAlternateFileName="")) returned 0 [0034.902] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.902] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gjcKm.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gjckm.png")) returned 1 [0034.903] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\gjcKm.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gjckm.png")) returned 0xffffffff [0034.904] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46e1a20, ftCreationTime.dwHighDateTime=0x1d4cf43, ftLastAccessTime.dwLowDateTime=0x9471ce20, ftLastAccessTime.dwHighDateTime=0x1d4cfba, ftLastWriteTime.dwLowDateTime=0x9471ce20, ftLastWriteTime.dwHighDateTime=0x1d4cfba, nFileSizeHigh=0x0, nFileSizeLow=0xd8b9, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="IJ5_x.flv", cAlternateFileName="")) returned 1 [0034.904] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c11ed0, ftCreationTime.dwHighDateTime=0x1d4ce96, ftLastAccessTime.dwLowDateTime=0x74a328a0, ftLastAccessTime.dwHighDateTime=0x1d4c86c, ftLastWriteTime.dwLowDateTime=0x74a328a0, ftLastWriteTime.dwHighDateTime=0x1d4c86c, nFileSizeHigh=0x0, nFileSizeLow=0xef16, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="jG3vzNQGM1CtOvm6pf.m4a", cAlternateFileName="JG3VZN~1.M4A")) returned 1 [0034.904] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9b8340, ftCreationTime.dwHighDateTime=0x1d4d3d9, ftLastAccessTime.dwLowDateTime=0xe2787610, ftLastAccessTime.dwHighDateTime=0x1d4d0f4, ftLastWriteTime.dwLowDateTime=0xe2787610, ftLastWriteTime.dwHighDateTime=0x1d4d0f4, nFileSizeHigh=0x0, nFileSizeLow=0x6219, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="jzvXZWBC2RYZP.odt", cAlternateFileName="JZVXZW~1.ODT")) returned 1 [0034.904] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3529d0, ftCreationTime.dwHighDateTime=0x1d4d3ba, ftLastAccessTime.dwLowDateTime=0xc1f3e5c0, ftLastAccessTime.dwHighDateTime=0x1d4cb61, ftLastWriteTime.dwLowDateTime=0xc1f3e5c0, ftLastWriteTime.dwHighDateTime=0x1d4cb61, nFileSizeHigh=0x0, nFileSizeLow=0x1699b, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="L32hcyZtEpundH.gif", cAlternateFileName="L32HCY~1.GIF")) returned 1 [0034.904] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90df9e50, ftCreationTime.dwHighDateTime=0x1d4d239, ftLastAccessTime.dwLowDateTime=0x82d82370, ftLastAccessTime.dwHighDateTime=0x1d4cdb3, ftLastWriteTime.dwLowDateTime=0x82d82370, ftLastWriteTime.dwHighDateTime=0x1d4cdb3, nFileSizeHigh=0x0, nFileSizeLow=0x55a7, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="m1sLm.odp", cAlternateFileName="")) returned 1 [0034.904] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed900170, ftCreationTime.dwHighDateTime=0x1d4cf2e, ftLastAccessTime.dwLowDateTime=0x8a887570, ftLastAccessTime.dwHighDateTime=0x1d4d173, ftLastWriteTime.dwLowDateTime=0x8a887570, ftLastWriteTime.dwHighDateTime=0x1d4d173, nFileSizeHigh=0x0, nFileSizeLow=0x3366, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="MhBfTwQVfw35OGKm.m4a", cAlternateFileName="MHBFTW~1.M4A")) returned 1 [0034.904] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f68220, ftCreationTime.dwHighDateTime=0x1d4c914, ftLastAccessTime.dwLowDateTime=0xd0c8e730, ftLastAccessTime.dwHighDateTime=0x1d4d052, ftLastWriteTime.dwLowDateTime=0xd0c8e730, ftLastWriteTime.dwHighDateTime=0x1d4d052, nFileSizeHigh=0x0, nFileSizeLow=0x4d0f, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="moa2K41f.rtf", cAlternateFileName="")) returned 1 [0034.904] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81b54c00, ftCreationTime.dwHighDateTime=0x1d4ca4a, ftLastAccessTime.dwLowDateTime=0x5cd0a9a0, ftLastAccessTime.dwHighDateTime=0x1d4cbcd, ftLastWriteTime.dwLowDateTime=0x5cd0a9a0, ftLastWriteTime.dwHighDateTime=0x1d4cbcd, nFileSizeHigh=0x0, nFileSizeLow=0x8f45, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="ormD1bwYTJ2PVU.png", cAlternateFileName="ORMD1B~1.PNG")) returned 1 [0034.904] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ormD1bwYTJ2PVU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ormd1bwytj2pvu.png")) returned 0x20 [0034.904] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ormD1bwYTJ2PVU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ormd1bwytj2pvu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.904] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ormD1bwYTJ2PVU.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ormd1bwytj2pvu.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.905] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.905] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.906] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.906] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.906] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.906] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.906] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.907] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.907] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.907] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.907] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.907] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.907] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.907] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.908] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.908] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.908] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0xf45, lpOverlapped=0x0) returned 1 [0034.908] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0xf45, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0xf45, lpOverlapped=0x0) returned 1 [0034.908] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.908] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.908] CloseHandle (hObject=0xec) returned 1 [0034.908] CloseHandle (hObject=0xf8) returned 1 [0034.909] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ormD1bwYTJ2PVU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ormd1bwytj2pvu.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ormD1bwYTJ2PVU.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ormd1bwytj2pvu.png.crypt")) returned 0 [0034.909] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ormD1bwYTJ2PVU.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ormd1bwytj2pvu.png.crypt")) returned 0x20 [0034.909] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ormD1bwYTJ2PVU.png", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81b54c00, ftCreationTime.dwHighDateTime=0x1d4ca4a, ftLastAccessTime.dwLowDateTime=0x5cd0a9a0, ftLastAccessTime.dwHighDateTime=0x1d4cbcd, ftLastWriteTime.dwLowDateTime=0x5cd0a9a0, ftLastWriteTime.dwHighDateTime=0x1d4cbcd, nFileSizeHigh=0x0, nFileSizeLow=0x8f45, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="ormD1bwYTJ2PVU.png", cAlternateFileName="ORMD1B~1.PNG")) returned 0x5c8ec0 [0034.909] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81b54c00, ftCreationTime.dwHighDateTime=0x1d4ca4a, ftLastAccessTime.dwLowDateTime=0x5cd0a9a0, ftLastAccessTime.dwHighDateTime=0x1d4cbcd, ftLastWriteTime.dwLowDateTime=0x5cd0a9a0, ftLastWriteTime.dwHighDateTime=0x1d4cbcd, nFileSizeHigh=0x0, nFileSizeLow=0x8f45, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="ormD1bwYTJ2PVU.png", cAlternateFileName="ORMD1B~1.PNG")) returned 0 [0034.909] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.909] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ormD1bwYTJ2PVU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ormd1bwytj2pvu.png")) returned 1 [0034.911] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ormD1bwYTJ2PVU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ormd1bwytj2pvu.png")) returned 0xffffffff [0034.911] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104fc00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9104fc00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x8fd3cf00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="search1.exe", cAlternateFileName="")) returned 1 [0034.911] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d62d20, ftCreationTime.dwHighDateTime=0x1d4d08e, ftLastAccessTime.dwLowDateTime=0xc0d00d90, ftLastAccessTime.dwHighDateTime=0x1d4d4d5, ftLastWriteTime.dwLowDateTime=0xc0d00d90, ftLastWriteTime.dwHighDateTime=0x1d4d4d5, nFileSizeHigh=0x0, nFileSizeLow=0x37a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYrO3Uqr5m.doc", cAlternateFileName="SYRO3U~1.DOC")) returned 1 [0034.911] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1526fe10, ftCreationTime.dwHighDateTime=0x1d4ce66, ftLastAccessTime.dwLowDateTime=0x3dc6e80, ftLastAccessTime.dwHighDateTime=0x1d4d125, ftLastWriteTime.dwLowDateTime=0x3dc6e80, ftLastWriteTime.dwHighDateTime=0x1d4d125, nFileSizeHigh=0x0, nFileSizeLow=0x12dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VyfcFK-R3a9.bmp", cAlternateFileName="VYFCFK~1.BMP")) returned 1 [0034.911] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x884dbca0, ftCreationTime.dwHighDateTime=0x1d4c67b, ftLastAccessTime.dwLowDateTime=0xec5f7db0, ftLastAccessTime.dwHighDateTime=0x1d4d110, ftLastWriteTime.dwLowDateTime=0xec5f7db0, ftLastWriteTime.dwHighDateTime=0x1d4d110, nFileSizeHigh=0x0, nFileSizeLow=0x3592, dwReserved0=0x0, dwReserved1=0x0, cFileName="WAi1jwpO1En.mp3", cAlternateFileName="WAI1JW~1.MP3")) returned 1 [0034.911] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31f8b220, ftCreationTime.dwHighDateTime=0x1d4d020, ftLastAccessTime.dwLowDateTime=0xd86efa00, ftLastAccessTime.dwHighDateTime=0x1d4d1e3, ftLastWriteTime.dwLowDateTime=0xd86efa00, ftLastWriteTime.dwHighDateTime=0x1d4d1e3, nFileSizeHigh=0x0, nFileSizeLow=0x15d5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xcOG-kT40w_1.mp3", cAlternateFileName="XCOG-K~1.MP3")) returned 1 [0034.911] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46370560, ftCreationTime.dwHighDateTime=0x1d4ce55, ftLastAccessTime.dwLowDateTime=0x709040e0, ftLastAccessTime.dwHighDateTime=0x1d4d3cf, ftLastWriteTime.dwLowDateTime=0x709040e0, ftLastWriteTime.dwHighDateTime=0x1d4d3cf, nFileSizeHigh=0x0, nFileSizeLow=0x76b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="yi5Fra9ft4.mp4", cAlternateFileName="YI5FRA~1.MP4")) returned 1 [0034.911] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c72b0a0, ftCreationTime.dwHighDateTime=0x1d4d3a7, ftLastAccessTime.dwLowDateTime=0xd07990c0, ftLastAccessTime.dwHighDateTime=0x1d4c825, ftLastWriteTime.dwLowDateTime=0xd07990c0, ftLastWriteTime.dwHighDateTime=0x1d4c825, nFileSizeHigh=0x0, nFileSizeLow=0xa36, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZEoBqRXpotPIws.flv", cAlternateFileName="ZEOBQR~1.FLV")) returned 1 [0034.911] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa2c39b0, ftCreationTime.dwHighDateTime=0x1d4ce68, ftLastAccessTime.dwLowDateTime=0x7256ac20, ftLastAccessTime.dwHighDateTime=0x1d4cd44, ftLastWriteTime.dwLowDateTime=0x7256ac20, ftLastWriteTime.dwHighDateTime=0x1d4cd44, nFileSizeHigh=0x0, nFileSizeLow=0x1877f, dwReserved0=0x0, dwReserved1=0x0, cFileName="zl843XUZ-N90kI2vZ3.avi", cAlternateFileName="ZL843X~1.AVI")) returned 1 [0034.911] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe65a16f0, ftCreationTime.dwHighDateTime=0x1d4d04d, ftLastAccessTime.dwLowDateTime=0x2092b230, ftLastAccessTime.dwHighDateTime=0x1d4cf38, ftLastWriteTime.dwLowDateTime=0x2092b230, ftLastWriteTime.dwHighDateTime=0x1d4cf38, nFileSizeHigh=0x0, nFileSizeLow=0x4735, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZsjQKdPOBo.swf", cAlternateFileName="ZSJQKD~1.SWF")) returned 1 [0034.911] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2bbd10, ftCreationTime.dwHighDateTime=0x1d4cdab, ftLastAccessTime.dwLowDateTime=0x525219d0, ftLastAccessTime.dwHighDateTime=0x1d4cd5a, ftLastWriteTime.dwLowDateTime=0x525219d0, ftLastWriteTime.dwHighDateTime=0x1d4cd5a, nFileSizeHigh=0x0, nFileSizeLow=0x11698, dwReserved0=0x0, dwReserved1=0x0, cFileName="_HZMpmSMDeXQp.wav", cAlternateFileName="_HZMPM~1.WAV")) returned 1 [0034.911] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe06dcef0, ftCreationTime.dwHighDateTime=0x1d4cfb5, ftLastAccessTime.dwLowDateTime=0xaa9d9d20, ftLastAccessTime.dwHighDateTime=0x1d4cb08, ftLastWriteTime.dwLowDateTime=0xaa9d9d20, ftLastWriteTime.dwHighDateTime=0x1d4cb08, nFileSizeHigh=0x0, nFileSizeLow=0x11d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="_zV ld0rkKX1LQg7da.csv", cAlternateFileName="_ZVLD0~1.CSV")) returned 1 [0034.911] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe06dcef0, ftCreationTime.dwHighDateTime=0x1d4cfb5, ftLastAccessTime.dwLowDateTime=0xaa9d9d20, ftLastAccessTime.dwHighDateTime=0x1d4cb08, ftLastWriteTime.dwLowDateTime=0xaa9d9d20, ftLastWriteTime.dwHighDateTime=0x1d4cb08, nFileSizeHigh=0x0, nFileSizeLow=0x11d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="_zV ld0rkKX1LQg7da.csv", cAlternateFileName="_ZVLD0~1.CSV")) returned 0 [0034.912] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0034.912] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fb7320, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x94fb7320, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67514c31, dwReserved1=0x2e616437, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0034.912] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fb7320, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x94fb7320, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0034.912] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fb7320, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x94fb7320, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.912] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e1c0b0, ftCreationTime.dwHighDateTime=0x1d4d4be, ftLastAccessTime.dwLowDateTime=0xe5afd50, ftLastAccessTime.dwHighDateTime=0x1d4d214, ftLastWriteTime.dwLowDateTime=0xe5afd50, ftLastWriteTime.dwHighDateTime=0x1d4d214, nFileSizeHigh=0x0, nFileSizeLow=0x613c, dwReserved0=0x0, dwReserved1=0x0, cFileName="1lgdOtiNG.csv", cAlternateFileName="1LGDOT~1.CSV")) returned 1 [0034.912] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42292cb0, ftCreationTime.dwHighDateTime=0x1d4cfb2, ftLastAccessTime.dwLowDateTime=0x8f64d240, ftLastAccessTime.dwHighDateTime=0x1d4cd64, ftLastWriteTime.dwLowDateTime=0x8f64d240, ftLastWriteTime.dwHighDateTime=0x1d4cd64, nFileSizeHigh=0x0, nFileSizeLow=0x197d, dwReserved0=0x0, dwReserved1=0x0, cFileName="2-v8OsluyXo6NQ.pps", cAlternateFileName="2-V8OS~1.PPS")) returned 1 [0034.912] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeaa4fa0, ftCreationTime.dwHighDateTime=0x1d51af9, ftLastAccessTime.dwLowDateTime=0x2be1f30, ftLastAccessTime.dwHighDateTime=0x1d4f993, ftLastWriteTime.dwLowDateTime=0x2be1f30, ftLastWriteTime.dwHighDateTime=0x1d4f993, nFileSizeHigh=0x0, nFileSizeLow=0x3ccf, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Qy9fNpQyCJ 70GH9.xlsx", cAlternateFileName="2QY9FN~1.XLS")) returned 1 [0034.912] VirtualAlloc (lpAddress=0x31c8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31c8000 [0034.912] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf96574f0, ftCreationTime.dwHighDateTime=0x1d4c7de, ftLastAccessTime.dwLowDateTime=0x83cceb30, ftLastAccessTime.dwHighDateTime=0x1d4d37b, ftLastWriteTime.dwLowDateTime=0x83cceb30, ftLastWriteTime.dwHighDateTime=0x1d4d37b, nFileSizeHigh=0x0, nFileSizeLow=0x2c59, dwReserved0=0x0, dwReserved1=0x0, cFileName="3bgp1RW3KcVuB5mMAG.doc", cAlternateFileName="3BGP1R~1.DOC")) returned 1 [0034.912] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa827be80, ftCreationTime.dwHighDateTime=0x1d531bb, ftLastAccessTime.dwLowDateTime=0x369ea470, ftLastAccessTime.dwHighDateTime=0x1d5259c, ftLastWriteTime.dwLowDateTime=0x369ea470, ftLastWriteTime.dwHighDateTime=0x1d5259c, nFileSizeHigh=0x0, nFileSizeLow=0x1196a, dwReserved0=0x0, dwReserved1=0x0, cFileName="7H_dTpHa.xlsx", cAlternateFileName="7H_DTP~1.XLS")) returned 1 [0034.912] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd6030, ftCreationTime.dwHighDateTime=0x1d4cb87, ftLastAccessTime.dwLowDateTime=0x5e46d7f0, ftLastAccessTime.dwHighDateTime=0x1d4c835, ftLastWriteTime.dwLowDateTime=0x5e46d7f0, ftLastWriteTime.dwHighDateTime=0x1d4c835, nFileSizeHigh=0x0, nFileSizeLow=0x46f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACyV4Fg44jp6azL.ods", cAlternateFileName="ACYV4F~1.ODS")) returned 1 [0034.912] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27386290, ftCreationTime.dwHighDateTime=0x1d4d1a6, ftLastAccessTime.dwLowDateTime=0x7e81dba0, ftLastAccessTime.dwHighDateTime=0x1d4c7b3, ftLastWriteTime.dwLowDateTime=0x7e81dba0, ftLastWriteTime.dwHighDateTime=0x1d4c7b3, nFileSizeHigh=0x0, nFileSizeLow=0xfeba, dwReserved0=0x0, dwReserved1=0x0, cFileName="aIhTDD.xls", cAlternateFileName="")) returned 1 [0034.912] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4b4ac60, ftCreationTime.dwHighDateTime=0x1d4e970, ftLastAccessTime.dwLowDateTime=0x47eb7720, ftLastAccessTime.dwHighDateTime=0x1d4c689, ftLastWriteTime.dwLowDateTime=0x47eb7720, ftLastWriteTime.dwHighDateTime=0x1d4c689, nFileSizeHigh=0x0, nFileSizeLow=0x1503a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BEOeKw eDuhD3.docx", cAlternateFileName="BEOEKW~1.DOC")) returned 1 [0034.912] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x695fdc0, ftCreationTime.dwHighDateTime=0x1d4cbd6, ftLastAccessTime.dwLowDateTime=0x7f4fa3f0, ftLastAccessTime.dwHighDateTime=0x1d4c858, ftLastWriteTime.dwLowDateTime=0x7f4fa3f0, ftLastWriteTime.dwHighDateTime=0x1d4c858, nFileSizeHigh=0x0, nFileSizeLow=0xd967, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ck22L.rtf", cAlternateFileName="")) returned 1 [0034.912] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc26e2a0, ftCreationTime.dwHighDateTime=0x1d4d3ea, ftLastAccessTime.dwLowDateTime=0x540dbb30, ftLastAccessTime.dwHighDateTime=0x1d4d56b, ftLastWriteTime.dwLowDateTime=0x540dbb30, ftLastWriteTime.dwHighDateTime=0x1d4d56b, nFileSizeHigh=0x0, nFileSizeLow=0xbcdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ctgIJ7lZLN2CGput Xl.ots", cAlternateFileName="CTGIJ7~1.OTS")) returned 1 [0034.912] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.912] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini")) returned 0x26 [0034.913] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.913] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.913] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x192, lpOverlapped=0x0) returned 1 [0034.914] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x192, lpOverlapped=0x0) returned 1 [0034.915] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.915] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.915] CloseHandle (hObject=0xf8) returned 1 [0034.915] CloseHandle (hObject=0xec) returned 1 [0034.915] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini.crypt")) returned 0 [0034.915] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini.crypt")) returned 0x20 [0034.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0034.915] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.915] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.915] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini")) returned 1 [0034.916] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\desktop.ini")) returned 0xffffffff [0034.916] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd901a70, ftCreationTime.dwHighDateTime=0x1d4d03e, ftLastAccessTime.dwLowDateTime=0xa9aed5c0, ftLastAccessTime.dwHighDateTime=0x1d4ea14, ftLastWriteTime.dwLowDateTime=0xa9aed5c0, ftLastWriteTime.dwHighDateTime=0x1d4ea14, nFileSizeHigh=0x0, nFileSizeLow=0xf1b6, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="DXvVoXwv.pptx", cAlternateFileName="DXVVOX~1.PPT")) returned 1 [0034.916] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b203130, ftCreationTime.dwHighDateTime=0x1d4cfb6, ftLastAccessTime.dwLowDateTime=0xbd12d5f0, ftLastAccessTime.dwHighDateTime=0x1d4ef99, ftLastWriteTime.dwLowDateTime=0xbd12d5f0, ftLastWriteTime.dwHighDateTime=0x1d4ef99, nFileSizeHigh=0x0, nFileSizeLow=0x14c2c, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="fgkJ1j.pptx", cAlternateFileName="FGKJ1J~1.PPT")) returned 1 [0034.916] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229c6050, ftCreationTime.dwHighDateTime=0x1d4ca13, ftLastAccessTime.dwLowDateTime=0x9a531b50, ftLastAccessTime.dwHighDateTime=0x1d4d19f, ftLastWriteTime.dwLowDateTime=0x9a531b50, ftLastWriteTime.dwHighDateTime=0x1d4d19f, nFileSizeHigh=0x0, nFileSizeLow=0x1019e, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Gepf8q naWWdA3Hh.odt", cAlternateFileName="GEPF8Q~1.ODT")) returned 1 [0034.916] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee697180, ftCreationTime.dwHighDateTime=0x1d4ca4c, ftLastAccessTime.dwLowDateTime=0xb5f70a50, ftLastAccessTime.dwHighDateTime=0x1d4c70f, ftLastWriteTime.dwLowDateTime=0xb5f70a50, ftLastWriteTime.dwHighDateTime=0x1d4c70f, nFileSizeHigh=0x0, nFileSizeLow=0xce4a, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="gOVPRFjodhzZVtG.doc", cAlternateFileName="GOVPRF~1.DOC")) returned 1 [0034.916] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83cfc70, ftCreationTime.dwHighDateTime=0x1d4fbd1, ftLastAccessTime.dwLowDateTime=0x490be870, ftLastAccessTime.dwHighDateTime=0x1d52074, ftLastWriteTime.dwLowDateTime=0x490be870, ftLastWriteTime.dwHighDateTime=0x1d52074, nFileSizeHigh=0x0, nFileSizeLow=0x14780, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="gWma.pptx", cAlternateFileName="GWMA~1.PPT")) returned 1 [0034.917] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f35e530, ftCreationTime.dwHighDateTime=0x1d4c597, ftLastAccessTime.dwLowDateTime=0xf7fe5270, ftLastAccessTime.dwHighDateTime=0x1d4ce42, ftLastWriteTime.dwLowDateTime=0xf7fe5270, ftLastWriteTime.dwHighDateTime=0x1d4ce42, nFileSizeHigh=0x0, nFileSizeLow=0xbb91, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="I8sW8qFtvHq_OBx.odp", cAlternateFileName="I8SW8Q~1.ODP")) returned 1 [0034.917] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70eb8360, ftCreationTime.dwHighDateTime=0x1d4c5f1, ftLastAccessTime.dwLowDateTime=0x46dc7210, ftLastAccessTime.dwHighDateTime=0x1d4ca00, ftLastWriteTime.dwLowDateTime=0x46dc7210, ftLastWriteTime.dwHighDateTime=0x1d4ca00, nFileSizeHigh=0x0, nFileSizeLow=0x185ac, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="ixcTUA2MdhOdrM8T-je.pps", cAlternateFileName="IXCTUA~1.PPS")) returned 1 [0034.917] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b4284b0, ftCreationTime.dwHighDateTime=0x1d4c540, ftLastAccessTime.dwLowDateTime=0x2e76ac60, ftLastAccessTime.dwHighDateTime=0x1d4c611, ftLastWriteTime.dwLowDateTime=0x2e76ac60, ftLastWriteTime.dwHighDateTime=0x1d4c611, nFileSizeHigh=0x0, nFileSizeLow=0x11d05, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="jFlm5M5isN1V6QsQFljh.doc", cAlternateFileName="JFLM5M~1.DOC")) returned 1 [0034.917] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ee71a0, ftCreationTime.dwHighDateTime=0x1d4ca7a, ftLastAccessTime.dwLowDateTime=0xf2162ee0, ftLastAccessTime.dwHighDateTime=0x1d5014c, ftLastWriteTime.dwLowDateTime=0xf2162ee0, ftLastWriteTime.dwHighDateTime=0x1d5014c, nFileSizeHigh=0x0, nFileSizeLow=0x6e16, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="LcEzmMI.xlsx", cAlternateFileName="LCEZMM~1.XLS")) returned 1 [0034.917] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96c032a0, ftCreationTime.dwHighDateTime=0x1d4cbe3, ftLastAccessTime.dwLowDateTime=0x89a92780, ftLastAccessTime.dwHighDateTime=0x1d4c9a8, ftLastWriteTime.dwLowDateTime=0x89a92780, ftLastWriteTime.dwHighDateTime=0x1d4c9a8, nFileSizeHigh=0x0, nFileSizeLow=0x12c66, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="LmtSVhfzw.ppt", cAlternateFileName="LMTSVH~1.PPT")) returned 1 [0034.917] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x649fb4e0, ftCreationTime.dwHighDateTime=0x1d4c692, ftLastAccessTime.dwLowDateTime=0x9ecb7490, ftLastAccessTime.dwHighDateTime=0x1d4c74d, ftLastWriteTime.dwLowDateTime=0x9ecb7490, ftLastWriteTime.dwHighDateTime=0x1d4c74d, nFileSizeHigh=0x0, nFileSizeLow=0x17dad, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="lovM7zTe54ZDP.pdf", cAlternateFileName="LOVM7Z~1.PDF")) returned 1 [0034.917] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0034.917] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x18f6e8, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18f630, ftLastAccessTime.dwLowDateTime=0x40dea8, ftLastAccessTime.dwHighDateTime=0x40deb0, ftLastWriteTime.dwLowDateTime=0x212ef4, ftLastWriteTime.dwHighDateTime=0x18f710, nFileSizeHigh=0x211d34, nFileSizeLow=0x1, dwReserved0=0xffffffff, dwReserved1=0x0, cFileName="", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0034.917] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0034.917] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x18f6e8, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x18f630, ftLastAccessTime.dwLowDateTime=0x40dea8, ftLastAccessTime.dwHighDateTime=0x40deb0, ftLastWriteTime.dwLowDateTime=0x212ef4, ftLastWriteTime.dwHighDateTime=0x18f710, nFileSizeHigh=0x211d34, nFileSizeLow=0x1, dwReserved0=0xffffffff, dwReserved1=0x0, cFileName="", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0034.917] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0034.917] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0034.918] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.918] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x66, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.918] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini")) returned 0x2 [0034.921] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.921] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.923] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xd8, lpOverlapped=0x0) returned 1 [0034.924] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xd8, lpOverlapped=0x0) returned 1 [0034.925] ReadFile (in: hFile=0xf8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0034.925] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0034.925] CloseHandle (hObject=0xf8) returned 1 [0034.925] CloseHandle (hObject=0x114) returned 1 [0034.925] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini.crypt")) returned 0 [0034.925] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini.crypt")) returned 0x20 [0034.925] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f00 [0034.925] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.925] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0034.925] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini")) returned 1 [0034.926] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\desktop.ini")) returned 0xffffffff [0034.926] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0034.926] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="_private", cAlternateFileName="")) returned 1 [0034.926] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0034.927] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.927] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x7a, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0034.927] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x7a, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0034.927] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0034.927] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="_private", cAlternateFileName="")) returned 0 [0034.927] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.927] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0034.927] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="_private", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0034.927] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10a20420, ftCreationTime.dwHighDateTime=0x1d4cfc4, ftLastAccessTime.dwLowDateTime=0x77c61c90, ftLastAccessTime.dwHighDateTime=0x1d4d37a, ftLastWriteTime.dwLowDateTime=0x77c61c90, ftLastWriteTime.dwHighDateTime=0x1d4d37a, nFileSizeHigh=0x0, nFileSizeLow=0xad6c, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="nI67Wp8LP7.ppt", cAlternateFileName="NI67WP~1.PPT")) returned 1 [0034.927] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10a03f90, ftCreationTime.dwHighDateTime=0x1d4c575, ftLastAccessTime.dwLowDateTime=0xcddb17b0, ftLastAccessTime.dwHighDateTime=0x1d4d4d4, ftLastWriteTime.dwLowDateTime=0xcddb17b0, ftLastWriteTime.dwHighDateTime=0x1d4d4d4, nFileSizeHigh=0x0, nFileSizeLow=0x5e46, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="nJaxoH3z6.pptx", cAlternateFileName="NJAXOH~1.PPT")) returned 1 [0034.927] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe573e000, ftCreationTime.dwHighDateTime=0x1d4c8d6, ftLastAccessTime.dwLowDateTime=0x62273d50, ftLastAccessTime.dwHighDateTime=0x1d4d3e4, ftLastWriteTime.dwLowDateTime=0x62273d50, ftLastWriteTime.dwHighDateTime=0x1d4d3e4, nFileSizeHigh=0x0, nFileSizeLow=0x9ea1, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="nL2dk-97jFEcTR.docx", cAlternateFileName="NL2DK-~1.DOC")) returned 1 [0034.927] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x539b0a20, ftCreationTime.dwHighDateTime=0x1d4c960, ftLastAccessTime.dwLowDateTime=0x51890980, ftLastAccessTime.dwHighDateTime=0x1d4d365, ftLastWriteTime.dwLowDateTime=0x51890980, ftLastWriteTime.dwHighDateTime=0x1d4d365, nFileSizeHigh=0x0, nFileSizeLow=0xea22, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="NPyBn4PYfD0Uer9-.pdf", cAlternateFileName="NPYBN4~1.PDF")) returned 1 [0034.927] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0034.927] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0034.928] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="..", cAlternateFileName="")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0034.928] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebcbbd0, ftCreationTime.dwHighDateTime=0x1d525cc, ftLastAccessTime.dwLowDateTime=0x66bda870, ftLastAccessTime.dwHighDateTime=0x1d4cecd, ftLastWriteTime.dwLowDateTime=0x66bda870, ftLastWriteTime.dwHighDateTime=0x1d4cecd, nFileSizeHigh=0x0, nFileSizeLow=0xa97a, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="PnJy.docx", cAlternateFileName="PNJY~1.DOC")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3aa31860, ftCreationTime.dwHighDateTime=0x1d4c7a7, ftLastAccessTime.dwLowDateTime=0x1bca7800, ftLastAccessTime.dwHighDateTime=0x1d4d3a7, ftLastWriteTime.dwLowDateTime=0x1bca7800, ftLastWriteTime.dwHighDateTime=0x1d4d3a7, nFileSizeHigh=0x0, nFileSizeLow=0xe17c, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="QWKwKdI.pps", cAlternateFileName="")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73828380, ftCreationTime.dwHighDateTime=0x1d4d019, ftLastAccessTime.dwLowDateTime=0x64f26400, ftLastAccessTime.dwHighDateTime=0x1d4d25f, ftLastWriteTime.dwLowDateTime=0x64f26400, ftLastWriteTime.dwHighDateTime=0x1d4d25f, nFileSizeHigh=0x0, nFileSizeLow=0x401c, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="RJTkAx3XvY.ods", cAlternateFileName="RJTKAX~1.ODS")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a9cea0, ftCreationTime.dwHighDateTime=0x1d4d5a2, ftLastAccessTime.dwLowDateTime=0x5806bc70, ftLastAccessTime.dwHighDateTime=0x1d4cf65, ftLastWriteTime.dwLowDateTime=0x5806bc70, ftLastWriteTime.dwHighDateTime=0x1d4cf65, nFileSizeHigh=0x0, nFileSizeLow=0xe343, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="RsbC_5Xwws.docx", cAlternateFileName="RSBC_5~1.DOC")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0d287c0, ftCreationTime.dwHighDateTime=0x1d4d1d8, ftLastAccessTime.dwLowDateTime=0xe2ae2b30, ftLastAccessTime.dwHighDateTime=0x1d4ca95, ftLastWriteTime.dwLowDateTime=0xe2ae2b30, ftLastWriteTime.dwHighDateTime=0x1d4ca95, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="RTNc lp7dm74RUn.xls", cAlternateFileName="RTNCLP~1.XLS")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8c72f0, ftCreationTime.dwHighDateTime=0x1d4caaf, ftLastAccessTime.dwLowDateTime=0xd1446090, ftLastAccessTime.dwHighDateTime=0x1d4d4b7, ftLastWriteTime.dwLowDateTime=0xd1446090, ftLastWriteTime.dwHighDateTime=0x1d4d4b7, nFileSizeHigh=0x0, nFileSizeLow=0x189df, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="svF1qlhEpB-.ots", cAlternateFileName="SVF1QL~1.OTS")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e2bb50, ftCreationTime.dwHighDateTime=0x1d4f51c, ftLastAccessTime.dwLowDateTime=0xe8837790, ftLastAccessTime.dwHighDateTime=0x1d4b46a, ftLastWriteTime.dwLowDateTime=0xe8837790, ftLastWriteTime.dwHighDateTime=0x1d4b46a, nFileSizeHigh=0x0, nFileSizeLow=0x261d, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="tSfS3txBVOn8wL_501.docx", cAlternateFileName="TSFS3T~1.DOC")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ba600, ftCreationTime.dwHighDateTime=0x1d4c8b1, ftLastAccessTime.dwLowDateTime=0xf8f8d70, ftLastAccessTime.dwHighDateTime=0x1d4cd79, ftLastWriteTime.dwLowDateTime=0xf8f8d70, ftLastWriteTime.dwHighDateTime=0x1d4cd79, nFileSizeHigh=0x0, nFileSizeLow=0xe892, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="uea73UW-Qa5hA_JDTHP.ods", cAlternateFileName="UEA73U~1.ODS")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9516d530, ftCreationTime.dwHighDateTime=0x1d4d282, ftLastAccessTime.dwLowDateTime=0x3213b1c0, ftLastAccessTime.dwHighDateTime=0x1d4d321, ftLastWriteTime.dwLowDateTime=0x3213b1c0, ftLastWriteTime.dwHighDateTime=0x1d4d321, nFileSizeHigh=0x0, nFileSizeLow=0x139c7, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="vaCw.rtf", cAlternateFileName="")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe13200, ftCreationTime.dwHighDateTime=0x1d4cd3a, ftLastAccessTime.dwLowDateTime=0x9ea9abd0, ftLastAccessTime.dwHighDateTime=0x1d4d36e, ftLastWriteTime.dwLowDateTime=0x9ea9abd0, ftLastWriteTime.dwHighDateTime=0x1d4d36e, nFileSizeHigh=0x0, nFileSizeLow=0x11e50, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="vinoLwfUsbpS4BWLGW.doc", cAlternateFileName="VINOLW~1.DOC")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe2d8b0, ftCreationTime.dwHighDateTime=0x1d4e221, ftLastAccessTime.dwLowDateTime=0xbfce5140, ftLastAccessTime.dwHighDateTime=0x1d52764, ftLastWriteTime.dwLowDateTime=0xbfce5140, ftLastWriteTime.dwHighDateTime=0x1d52764, nFileSizeHigh=0x0, nFileSizeLow=0x8ada, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="Wb85quJcmU45C5T.xlsx", cAlternateFileName="WB85QU~1.XLS")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3dbb40, ftCreationTime.dwHighDateTime=0x1d51653, ftLastAccessTime.dwLowDateTime=0xe3be3480, ftLastAccessTime.dwHighDateTime=0x1d4e4d4, ftLastWriteTime.dwLowDateTime=0xe3be3480, ftLastWriteTime.dwHighDateTime=0x1d4e4d4, nFileSizeHigh=0x0, nFileSizeLow=0x11a64, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="wkTfHmhLJX51r8i6Q.pptx", cAlternateFileName="WKTFHM~1.PPT")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b20a00, ftCreationTime.dwHighDateTime=0x1d4d9d7, ftLastAccessTime.dwLowDateTime=0x13e5c0d0, ftLastAccessTime.dwHighDateTime=0x1d527d1, ftLastWriteTime.dwLowDateTime=0x13e5c0d0, ftLastWriteTime.dwHighDateTime=0x1d527d1, nFileSizeHigh=0x0, nFileSizeLow=0xbd5f, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="wt5bUzyysPD.docx", cAlternateFileName="WT5BUZ~1.DOC")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee959d60, ftCreationTime.dwHighDateTime=0x1d4b5ce, ftLastAccessTime.dwLowDateTime=0xbcafe700, ftLastAccessTime.dwHighDateTime=0x1d4c4bb, ftLastWriteTime.dwLowDateTime=0xbcafe700, ftLastWriteTime.dwHighDateTime=0x1d4c4bb, nFileSizeHigh=0x0, nFileSizeLow=0xc776, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="WZ3imSrZcPAEZqerhj.xlsx", cAlternateFileName="WZ3IMS~1.XLS")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cce9790, ftCreationTime.dwHighDateTime=0x1d4c807, ftLastAccessTime.dwLowDateTime=0xcf2b69c0, ftLastAccessTime.dwHighDateTime=0x1d4d0d4, ftLastWriteTime.dwLowDateTime=0xcf2b69c0, ftLastWriteTime.dwHighDateTime=0x1d4d0d4, nFileSizeHigh=0x0, nFileSizeLow=0x806, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="X53u2qVjhd-p.xlsx", cAlternateFileName="X53U2Q~1.XLS")) returned 1 [0034.928] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3afaa10, ftCreationTime.dwHighDateTime=0x1d4cbff, ftLastAccessTime.dwLowDateTime=0xad2cd930, ftLastAccessTime.dwHighDateTime=0x1d4cc29, ftLastWriteTime.dwLowDateTime=0xad2cd930, ftLastWriteTime.dwHighDateTime=0x1d4cc29, nFileSizeHigh=0x0, nFileSizeLow=0x8c43, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="XCE6mWPwu1m.docx", cAlternateFileName="XCE6MW~1.DOC")) returned 1 [0034.929] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510f250, ftCreationTime.dwHighDateTime=0x1d4c98f, ftLastAccessTime.dwLowDateTime=0x529b8900, ftLastAccessTime.dwHighDateTime=0x1d4cb64, ftLastWriteTime.dwLowDateTime=0x529b8900, ftLastWriteTime.dwHighDateTime=0x1d4cb64, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="xt_DmRSH-_4BV2SH9.ots", cAlternateFileName="XT_DMR~1.OTS")) returned 1 [0034.929] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5332440, ftCreationTime.dwHighDateTime=0x1d526c5, ftLastAccessTime.dwLowDateTime=0xc42c5f30, ftLastAccessTime.dwHighDateTime=0x1d4c2d2, ftLastWriteTime.dwLowDateTime=0xc42c5f30, ftLastWriteTime.dwHighDateTime=0x1d4c2d2, nFileSizeHigh=0x0, nFileSizeLow=0x155e9, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="xWeKX.pptx", cAlternateFileName="XWEKX~1.PPT")) returned 1 [0034.929] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e55bcc0, ftCreationTime.dwHighDateTime=0x1d4d1de, ftLastAccessTime.dwLowDateTime=0xa41955b0, ftLastAccessTime.dwHighDateTime=0x1d4d446, ftLastWriteTime.dwLowDateTime=0xa41955b0, ftLastWriteTime.dwHighDateTime=0x1d4d446, nFileSizeHigh=0x0, nFileSizeLow=0xdbc1, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="YxcWeP1oYdIJLC6u.rtf", cAlternateFileName="YXCWEP~1.RTF")) returned 1 [0034.929] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15d1bf0, ftCreationTime.dwHighDateTime=0x1d4c9be, ftLastAccessTime.dwLowDateTime=0x62f9a6d0, ftLastAccessTime.dwHighDateTime=0x1d4c8d3, ftLastWriteTime.dwLowDateTime=0x62f9a6d0, ftLastWriteTime.dwHighDateTime=0x1d4c8d3, nFileSizeHigh=0x0, nFileSizeLow=0x11da7, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="Z1wt.ods", cAlternateFileName="")) returned 1 [0034.929] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fafd580, ftCreationTime.dwHighDateTime=0x1d4cc13, ftLastAccessTime.dwLowDateTime=0x7049acc0, ftLastAccessTime.dwHighDateTime=0x1d4eb4e, ftLastWriteTime.dwLowDateTime=0x7049acc0, ftLastWriteTime.dwHighDateTime=0x1d4eb4e, nFileSizeHigh=0x0, nFileSizeLow=0x15eb4, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="ZBK1QvsIC2F.docx", cAlternateFileName="ZBK1QV~1.DOC")) returned 1 [0034.929] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fafd580, ftCreationTime.dwHighDateTime=0x1d4cc13, ftLastAccessTime.dwLowDateTime=0x7049acc0, ftLastAccessTime.dwHighDateTime=0x1d4eb4e, ftLastWriteTime.dwLowDateTime=0x7049acc0, ftLastWriteTime.dwHighDateTime=0x1d4eb4e, nFileSizeHigh=0x0, nFileSizeLow=0x15eb4, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="ZBK1QvsIC2F.docx", cAlternateFileName="ZBK1QV~1.DOC")) returned 0 [0034.929] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0034.929] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x636f642e, dwReserved1=0x74722e78, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0034.929] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0034.929] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="..", cAlternateFileName="")) returned 1 [0034.929] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.929] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini")) returned 0x26 [0034.929] VirtualAlloc (lpAddress=0x31cc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31cc000 [0034.930] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.930] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.930] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x11a, lpOverlapped=0x0) returned 1 [0034.931] WriteFile (in: hFile=0x114, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x11a, lpOverlapped=0x0) returned 1 [0034.932] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.932] WriteFile (in: hFile=0x114, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.932] CloseHandle (hObject=0xec) returned 1 [0034.932] CloseHandle (hObject=0x114) returned 1 [0034.932] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini.crypt")) returned 0 [0034.932] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini.crypt")) returned 0x20 [0034.932] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0034.932] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.932] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.932] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini")) returned 1 [0034.933] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\desktop.ini")) returned 0xffffffff [0034.933] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.933] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0034.933] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x636f642e, dwReserved1=0x74722e78, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0034.933] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0034.933] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0034.933] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.934] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini")) returned 0x26 [0034.934] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.934] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.934] ReadFile (in: hFile=0x114, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x192, lpOverlapped=0x0) returned 1 [0034.935] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x192, lpOverlapped=0x0) returned 1 [0034.936] ReadFile (in: hFile=0x114, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.936] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.936] CloseHandle (hObject=0x114) returned 1 [0034.936] CloseHandle (hObject=0xec) returned 1 [0034.936] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini.crypt")) returned 0 [0034.936] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini.crypt")) returned 0x20 [0034.936] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0034.936] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.936] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.936] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini")) returned 1 [0034.937] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\desktop.ini")) returned 0xffffffff [0034.937] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Links", cAlternateFileName="")) returned 1 [0034.937] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0034.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x66, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.938] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini")) returned 0x6 [0034.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0034.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.947] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x50, lpOverlapped=0x0) returned 1 [0034.948] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x50, lpOverlapped=0x0) returned 1 [0034.949] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0034.949] WriteFile (in: hFile=0xf8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0034.949] CloseHandle (hObject=0x114) returned 1 [0034.949] CloseHandle (hObject=0xf8) returned 1 [0034.949] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini.crypt")) returned 0 [0034.949] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini.crypt")) returned 0x20 [0034.950] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f00 [0034.950] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.950] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0034.950] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini")) returned 1 [0034.950] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\desktop.ini")) returned 0xffffffff [0034.951] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0034.951] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0034.951] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0034.951] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.951] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x752e7972, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0034.951] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0034.952] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.952] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0034.952] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0034.952] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0034.952] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0034.952] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0034.952] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0034.953] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.953] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x6c72752e, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0034.953] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0034.956] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.957] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0034.957] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0034.957] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0034.957] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0034.957] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0034.957] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0034.957] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0034.957] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.957] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0034.957] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0034.959] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.959] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0034.959] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0034.959] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0034.959] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0034.959] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0034.959] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.960] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0034.960] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0034.960] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69736265, dwReserved1=0x74736574, cFileName="Links", cAlternateFileName="")) returned 1 [0034.960] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0034.960] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName="..", cAlternateFileName="")) returned 1 [0034.960] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.960] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini")) returned 0x6 [0034.960] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.960] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.961] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x244, lpOverlapped=0x0) returned 1 [0034.961] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x244, lpOverlapped=0x0) returned 1 [0034.962] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.962] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.962] CloseHandle (hObject=0xec) returned 1 [0034.962] CloseHandle (hObject=0xf8) returned 1 [0034.962] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini.crypt")) returned 0 [0034.963] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini.crypt")) returned 0x20 [0034.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0034.963] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.963] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.963] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini")) returned 1 [0034.964] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.ini")) returned 0xffffffff [0034.964] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0034.964] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk")) returned 0x20 [0034.965] VirtualAlloc (lpAddress=0x31d0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31d0000 [0034.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.965] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1e6, lpOverlapped=0x0) returned 1 [0034.966] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1e6, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1e6, lpOverlapped=0x0) returned 1 [0034.967] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.967] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.967] CloseHandle (hObject=0xf8) returned 1 [0034.967] CloseHandle (hObject=0xec) returned 1 [0034.967] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk.crypt")) returned 0 [0034.968] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk.crypt")) returned 0x20 [0034.968] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.lnk", cAlternateFileName="")) returned 0x5c8ec0 [0034.968] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.lnk", cAlternateFileName="")) returned 0 [0034.968] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.968] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk")) returned 1 [0034.969] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk")) returned 0xffffffff [0034.969] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0034.969] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk")) returned 0x20 [0034.969] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.969] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.970] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x3a1, lpOverlapped=0x0) returned 1 [0034.971] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x3a1, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x3a1, lpOverlapped=0x0) returned 1 [0034.972] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.972] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.972] CloseHandle (hObject=0xec) returned 1 [0034.972] CloseHandle (hObject=0xf8) returned 1 [0034.972] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk.crypt")) returned 0 [0034.972] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk.crypt")) returned 0x20 [0034.972] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 0x5c8ec0 [0034.972] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 0 [0034.972] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.972] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk")) returned 1 [0034.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk")) returned 0xffffffff [0034.973] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0034.973] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk")) returned 0x20 [0034.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.975] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x16b, lpOverlapped=0x0) returned 1 [0034.975] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x16b, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x16b, lpOverlapped=0x0) returned 1 [0034.976] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.976] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.976] CloseHandle (hObject=0xf8) returned 1 [0034.976] CloseHandle (hObject=0xec) returned 1 [0034.976] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk.crypt")) returned 0 [0034.977] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk.crypt")) returned 0x20 [0034.977] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0x5c8ec0 [0034.977] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0034.977] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.977] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk")) returned 1 [0034.978] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk")) returned 0xffffffff [0034.978] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0034.978] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0034.978] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7473656b, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0034.978] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="RecentPlaces.lnk", cAlternateFileName="\xb0\x4c\x5c")) returned 0xffffffff [0034.978] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x950035e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x950035e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7473656b, cFileName="Music", cAlternateFileName="")) returned 1 [0034.978] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x950035e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x950035e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0034.978] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x950035e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x950035e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0034.978] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4708acb0, ftCreationTime.dwHighDateTime=0x1d4d057, ftLastAccessTime.dwLowDateTime=0xc5a00b50, ftLastAccessTime.dwHighDateTime=0x1d4c994, ftLastWriteTime.dwLowDateTime=0xc5a00b50, ftLastWriteTime.dwHighDateTime=0x1d4c994, nFileSizeHigh=0x0, nFileSizeLow=0x14583, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="0XsC5s_924jv0GRX.wav", cAlternateFileName="0XSC5S~1.WAV")) returned 1 [0034.978] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b49f60, ftCreationTime.dwHighDateTime=0x1d4ce5a, ftLastAccessTime.dwLowDateTime=0xefaaa150, ftLastAccessTime.dwHighDateTime=0x1d4c9ce, ftLastWriteTime.dwLowDateTime=0xefaaa150, ftLastWriteTime.dwHighDateTime=0x1d4c9ce, nFileSizeHigh=0x0, nFileSizeLow=0x613e, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="125u29DHd_mnkQ.mp3", cAlternateFileName="125U29~1.MP3")) returned 1 [0034.978] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18466660, ftCreationTime.dwHighDateTime=0x1d4d4d0, ftLastAccessTime.dwLowDateTime=0x57cd87a0, ftLastAccessTime.dwHighDateTime=0x1d4cc7e, ftLastWriteTime.dwLowDateTime=0x57cd87a0, ftLastWriteTime.dwHighDateTime=0x1d4cc7e, nFileSizeHigh=0x0, nFileSizeLow=0xe17e, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="3ygnHyQmz.m4a", cAlternateFileName="3YGNHY~1.M4A")) returned 1 [0034.978] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4abe1420, ftCreationTime.dwHighDateTime=0x1d4ce55, ftLastAccessTime.dwLowDateTime=0xdc9bba0, ftLastAccessTime.dwHighDateTime=0x1d4c5a4, ftLastWriteTime.dwLowDateTime=0xdc9bba0, ftLastWriteTime.dwHighDateTime=0x1d4c5a4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="4WR0EV8pyK_9X", cAlternateFileName="4WR0EV~1")) returned 1 [0034.978] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4WR0EV8pyK_9X\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4abe1420, ftCreationTime.dwHighDateTime=0x1d4ce55, ftLastAccessTime.dwLowDateTime=0xdc9bba0, ftLastAccessTime.dwHighDateTime=0x1d4c5a4, ftLastWriteTime.dwLowDateTime=0xdc9bba0, ftLastWriteTime.dwHighDateTime=0x1d4c5a4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0034.978] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4abe1420, ftCreationTime.dwHighDateTime=0x1d4ce55, ftLastAccessTime.dwLowDateTime=0xdc9bba0, ftLastAccessTime.dwHighDateTime=0x1d4c5a4, ftLastWriteTime.dwLowDateTime=0xdc9bba0, ftLastWriteTime.dwHighDateTime=0x1d4c5a4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.978] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42279ee0, ftCreationTime.dwHighDateTime=0x1d4d4bc, ftLastAccessTime.dwLowDateTime=0xd8e47d10, ftLastAccessTime.dwHighDateTime=0x1d4d4e1, ftLastWriteTime.dwLowDateTime=0xd8e47d10, ftLastWriteTime.dwHighDateTime=0x1d4d4e1, nFileSizeHigh=0x0, nFileSizeLow=0x16781, dwReserved0=0x68, dwReserved1=0x0, cFileName="18a595--wOsYYVi.wav", cAlternateFileName="18A595~1.WAV")) returned 1 [0034.979] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95210c20, ftCreationTime.dwHighDateTime=0x1d4c973, ftLastAccessTime.dwLowDateTime=0xbb3dba20, ftLastAccessTime.dwHighDateTime=0x1d4c7c0, ftLastWriteTime.dwLowDateTime=0xbb3dba20, ftLastWriteTime.dwHighDateTime=0x1d4c7c0, nFileSizeHigh=0x0, nFileSizeLow=0xe3ea, dwReserved0=0x68, dwReserved1=0x0, cFileName="cX0yZfnD34NZL4l8.m4a", cAlternateFileName="CX0YZF~1.M4A")) returned 1 [0034.979] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b67fe0, ftCreationTime.dwHighDateTime=0x1d4cfb4, ftLastAccessTime.dwLowDateTime=0xfd22ff0, ftLastAccessTime.dwHighDateTime=0x1d4d093, ftLastWriteTime.dwLowDateTime=0xfd22ff0, ftLastWriteTime.dwHighDateTime=0x1d4d093, nFileSizeHigh=0x0, nFileSizeLow=0x1887e, dwReserved0=0x68, dwReserved1=0x0, cFileName="VoKgSnN0GRMpo.m4a", cAlternateFileName="VOKGSN~1.M4A")) returned 1 [0034.979] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd44027c0, ftCreationTime.dwHighDateTime=0x1d4cf4e, ftLastAccessTime.dwLowDateTime=0xb8dcad70, ftLastAccessTime.dwHighDateTime=0x1d4ce07, ftLastWriteTime.dwLowDateTime=0xb8dcad70, ftLastWriteTime.dwHighDateTime=0x1d4ce07, nFileSizeHigh=0x0, nFileSizeLow=0x3f6f, dwReserved0=0x68, dwReserved1=0x0, cFileName="W7wXV705BYEv_u-.mp3", cAlternateFileName="W7WXV7~1.MP3")) returned 1 [0034.979] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b633ff0, ftCreationTime.dwHighDateTime=0x1d4d52e, ftLastAccessTime.dwLowDateTime=0x61ce1030, ftLastAccessTime.dwHighDateTime=0x1d4d007, ftLastWriteTime.dwLowDateTime=0x61ce1030, ftLastWriteTime.dwHighDateTime=0x1d4d007, nFileSizeHigh=0x0, nFileSizeLow=0x9d93, dwReserved0=0x68, dwReserved1=0x0, cFileName="ytQapqIa_oXfRG-.mp3", cAlternateFileName="YTQAPQ~1.MP3")) returned 1 [0034.979] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b633ff0, ftCreationTime.dwHighDateTime=0x1d4d52e, ftLastAccessTime.dwLowDateTime=0x61ce1030, ftLastAccessTime.dwHighDateTime=0x1d4d007, ftLastWriteTime.dwLowDateTime=0x61ce1030, ftLastWriteTime.dwHighDateTime=0x1d4d007, nFileSizeHigh=0x0, nFileSizeLow=0x9d93, dwReserved0=0x68, dwReserved1=0x0, cFileName="ytQapqIa_oXfRG-.mp3", cAlternateFileName="YTQAPQ~1.MP3")) returned 0 [0034.979] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.979] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2d475266, dwReserved1=0x33706d2e, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.979] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini")) returned 0x26 [0034.979] VirtualAlloc (lpAddress=0x31d4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31d4000 [0034.979] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.979] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.980] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1f8, lpOverlapped=0x0) returned 1 [0034.980] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1f8, lpOverlapped=0x0) returned 1 [0034.981] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.981] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.981] CloseHandle (hObject=0xec) returned 1 [0034.981] CloseHandle (hObject=0xf8) returned 1 [0034.981] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini.crypt")) returned 0 [0034.982] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini.crypt")) returned 0x20 [0034.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0034.982] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0034.982] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.982] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini")) returned 1 [0034.983] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\desktop.ini")) returned 0xffffffff [0034.983] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e794e0, ftCreationTime.dwHighDateTime=0x1d4d2d3, ftLastAccessTime.dwLowDateTime=0x3f96f800, ftLastAccessTime.dwHighDateTime=0x1d4caef, ftLastWriteTime.dwLowDateTime=0x3f96f800, ftLastWriteTime.dwHighDateTime=0x1d4caef, nFileSizeHigh=0x0, nFileSizeLow=0x17ff4, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="GWiU2OqK7YyNgn.mp3", cAlternateFileName="GWIU2O~1.MP3")) returned 1 [0034.983] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50516080, ftCreationTime.dwHighDateTime=0x1d4cf0a, ftLastAccessTime.dwLowDateTime=0x86e69390, ftLastAccessTime.dwHighDateTime=0x1d4cf23, ftLastWriteTime.dwLowDateTime=0x86e69390, ftLastWriteTime.dwHighDateTime=0x1d4cf23, nFileSizeHigh=0x0, nFileSizeLow=0x421a, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="jsm-A.wav", cAlternateFileName="")) returned 1 [0034.983] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe73ee00, ftCreationTime.dwHighDateTime=0x1d4d264, ftLastAccessTime.dwLowDateTime=0xd5c75880, ftLastAccessTime.dwHighDateTime=0x1d4d376, ftLastWriteTime.dwLowDateTime=0xd5c75880, ftLastWriteTime.dwHighDateTime=0x1d4d376, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="m1LcNfC15e9dwL", cAlternateFileName="M1LCNF~1")) returned 1 [0034.983] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\m1LcNfC15e9dwL\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe73ee00, ftCreationTime.dwHighDateTime=0x1d4d264, ftLastAccessTime.dwLowDateTime=0xd5c75880, ftLastAccessTime.dwHighDateTime=0x1d4d376, ftLastWriteTime.dwLowDateTime=0xd5c75880, ftLastWriteTime.dwHighDateTime=0x1d4d376, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0034.983] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe73ee00, ftCreationTime.dwHighDateTime=0x1d4d264, ftLastAccessTime.dwLowDateTime=0xd5c75880, ftLastAccessTime.dwHighDateTime=0x1d4d376, ftLastWriteTime.dwLowDateTime=0xd5c75880, ftLastWriteTime.dwHighDateTime=0x1d4d376, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.983] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506bab40, ftCreationTime.dwHighDateTime=0x1d4c9a4, ftLastAccessTime.dwLowDateTime=0x29629660, ftLastAccessTime.dwHighDateTime=0x1d4c7b2, ftLastWriteTime.dwLowDateTime=0x29629660, ftLastWriteTime.dwHighDateTime=0x1d4c7b2, nFileSizeHigh=0x0, nFileSizeLow=0xd06e, dwReserved0=0x5e, dwReserved1=0x0, cFileName="-PAbKQMQvuXH.mp3", cAlternateFileName="-PABKQ~1.MP3")) returned 1 [0034.983] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc1313e0, ftCreationTime.dwHighDateTime=0x1d4d1c4, ftLastAccessTime.dwLowDateTime=0x3232ff60, ftLastAccessTime.dwHighDateTime=0x1d4c8f6, ftLastWriteTime.dwLowDateTime=0x3232ff60, ftLastWriteTime.dwHighDateTime=0x1d4c8f6, nFileSizeHigh=0x0, nFileSizeLow=0x4561, dwReserved0=0x5e, dwReserved1=0x0, cFileName="1Howj.wav", cAlternateFileName="")) returned 1 [0034.983] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafd8ab10, ftCreationTime.dwHighDateTime=0x1d4c8c2, ftLastAccessTime.dwLowDateTime=0x9502720, ftLastAccessTime.dwHighDateTime=0x1d4cf78, ftLastWriteTime.dwLowDateTime=0x9502720, ftLastWriteTime.dwHighDateTime=0x1d4cf78, nFileSizeHigh=0x0, nFileSizeLow=0x18acc, dwReserved0=0x5e, dwReserved1=0x0, cFileName="boMs.mp3", cAlternateFileName="")) returned 1 [0034.983] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb53d2b0, ftCreationTime.dwHighDateTime=0x1d4d3ab, ftLastAccessTime.dwLowDateTime=0x5704b390, ftLastAccessTime.dwHighDateTime=0x1d4cce5, ftLastWriteTime.dwLowDateTime=0x5704b390, ftLastWriteTime.dwHighDateTime=0x1d4cce5, nFileSizeHigh=0x0, nFileSizeLow=0x14690, dwReserved0=0x5e, dwReserved1=0x0, cFileName="C5IU6Fp.wav", cAlternateFileName="")) returned 1 [0034.983] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f26aa00, ftCreationTime.dwHighDateTime=0x1d4d4da, ftLastAccessTime.dwLowDateTime=0xd4d7b5f0, ftLastAccessTime.dwHighDateTime=0x1d4c881, ftLastWriteTime.dwLowDateTime=0xd4d7b5f0, ftLastWriteTime.dwHighDateTime=0x1d4c881, nFileSizeHigh=0x0, nFileSizeLow=0xcf8f, dwReserved0=0x5e, dwReserved1=0x0, cFileName="Imu5.wav", cAlternateFileName="")) returned 1 [0034.983] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb259e480, ftCreationTime.dwHighDateTime=0x1d4cf61, ftLastAccessTime.dwLowDateTime=0xc7010670, ftLastAccessTime.dwHighDateTime=0x1d4d34e, ftLastWriteTime.dwLowDateTime=0xc7010670, ftLastWriteTime.dwHighDateTime=0x1d4d34e, nFileSizeHigh=0x0, nFileSizeLow=0x131dc, dwReserved0=0x5e, dwReserved1=0x0, cFileName="JHFevy5nBWsYXkQuXD9.mp3", cAlternateFileName="JHFEVY~1.MP3")) returned 1 [0034.983] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe707b5d0, ftCreationTime.dwHighDateTime=0x1d4d39f, ftLastAccessTime.dwLowDateTime=0xba494880, ftLastAccessTime.dwHighDateTime=0x1d4d528, ftLastWriteTime.dwLowDateTime=0xba494880, ftLastWriteTime.dwHighDateTime=0x1d4d528, nFileSizeHigh=0x0, nFileSizeLow=0x1d6d, dwReserved0=0x5e, dwReserved1=0x0, cFileName="T8AizuA7Lu5772G.wav", cAlternateFileName="T8AIZU~1.WAV")) returned 1 [0034.983] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b1636c0, ftCreationTime.dwHighDateTime=0x1d4c69b, ftLastAccessTime.dwLowDateTime=0x8b299bd0, ftLastAccessTime.dwHighDateTime=0x1d4c55c, ftLastWriteTime.dwLowDateTime=0x8b299bd0, ftLastWriteTime.dwHighDateTime=0x1d4c55c, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x5e, dwReserved1=0x0, cFileName="VH5ALO.mp3", cAlternateFileName="")) returned 1 [0034.983] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f96c10, ftCreationTime.dwHighDateTime=0x1d4ca4d, ftLastAccessTime.dwLowDateTime=0xf5ec4230, ftLastAccessTime.dwHighDateTime=0x1d4d1ee, ftLastWriteTime.dwLowDateTime=0xf5ec4230, ftLastWriteTime.dwHighDateTime=0x1d4d1ee, nFileSizeHigh=0x0, nFileSizeLow=0x7be2, dwReserved0=0x5e, dwReserved1=0x0, cFileName="zg26LXXgtcYMWW3C_ZN.m4a", cAlternateFileName="ZG26LX~1.M4A")) returned 1 [0034.983] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366a16b0, ftCreationTime.dwHighDateTime=0x1d4d3e9, ftLastAccessTime.dwLowDateTime=0x91e1a940, ftLastAccessTime.dwHighDateTime=0x1d4c539, ftLastWriteTime.dwLowDateTime=0x91e1a940, ftLastWriteTime.dwHighDateTime=0x1d4c539, nFileSizeHigh=0x0, nFileSizeLow=0xabb8, dwReserved0=0x5e, dwReserved1=0x0, cFileName="__6nSD4.wav", cAlternateFileName="")) returned 1 [0034.983] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366a16b0, ftCreationTime.dwHighDateTime=0x1d4d3e9, ftLastAccessTime.dwLowDateTime=0x91e1a940, ftLastAccessTime.dwHighDateTime=0x1d4c539, ftLastWriteTime.dwLowDateTime=0x91e1a940, ftLastWriteTime.dwHighDateTime=0x1d4c539, nFileSizeHigh=0x0, nFileSizeLow=0xabb8, dwReserved0=0x5e, dwReserved1=0x0, cFileName="__6nSD4.wav", cAlternateFileName="")) returned 0 [0034.984] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.984] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b50570, ftCreationTime.dwHighDateTime=0x1d4d2ac, ftLastAccessTime.dwLowDateTime=0x1c765140, ftLastAccessTime.dwHighDateTime=0x1d4cb08, ftLastWriteTime.dwLowDateTime=0x1c765140, ftLastWriteTime.dwHighDateTime=0x1d4cb08, nFileSizeHigh=0x0, nFileSizeLow=0x17ac3, dwReserved0=0x3357574d, dwReserved1=0x4e5a5f43, cFileName="mcvrinqy.m4a", cAlternateFileName="")) returned 1 [0034.984] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e899b60, ftCreationTime.dwHighDateTime=0x1d4caa8, ftLastAccessTime.dwLowDateTime=0xd0d94140, ftLastAccessTime.dwHighDateTime=0x1d4cb78, ftLastWriteTime.dwLowDateTime=0xd0d94140, ftLastWriteTime.dwHighDateTime=0x1d4cb78, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3357574d, dwReserved1=0x4e5a5f43, cFileName="UIN", cAlternateFileName="")) returned 1 [0034.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UIN\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e899b60, ftCreationTime.dwHighDateTime=0x1d4caa8, ftLastAccessTime.dwLowDateTime=0xd0d94140, ftLastAccessTime.dwHighDateTime=0x1d4cb78, ftLastWriteTime.dwLowDateTime=0xd0d94140, ftLastWriteTime.dwHighDateTime=0x1d4cb78, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0034.984] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e899b60, ftCreationTime.dwHighDateTime=0x1d4caa8, ftLastAccessTime.dwLowDateTime=0xd0d94140, ftLastAccessTime.dwHighDateTime=0x1d4cb78, ftLastWriteTime.dwLowDateTime=0xd0d94140, ftLastWriteTime.dwHighDateTime=0x1d4cb78, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.984] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dccc7e0, ftCreationTime.dwHighDateTime=0x1d4c86e, ftLastAccessTime.dwLowDateTime=0x96fd53e0, ftLastAccessTime.dwHighDateTime=0x1d4c7cb, ftLastWriteTime.dwLowDateTime=0x96fd53e0, ftLastWriteTime.dwHighDateTime=0x1d4c7cb, nFileSizeHigh=0x0, nFileSizeLow=0x170d9, dwReserved0=0x5e, dwReserved1=0x0, cFileName="Ic--vnuNibIAvHMo.m4a", cAlternateFileName="IC--VN~1.M4A")) returned 1 [0034.984] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f12c960, ftCreationTime.dwHighDateTime=0x1d4d12f, ftLastAccessTime.dwLowDateTime=0xdfad8980, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xdfad8980, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0xc09e, dwReserved0=0x5e, dwReserved1=0x0, cFileName="PDX0mkOg3Hw.mp3", cAlternateFileName="PDX0MK~1.MP3")) returned 1 [0034.984] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de3a9f0, ftCreationTime.dwHighDateTime=0x1d4c744, ftLastAccessTime.dwLowDateTime=0x86d45bd0, ftLastAccessTime.dwHighDateTime=0x1d4d39c, ftLastWriteTime.dwLowDateTime=0x86d45bd0, ftLastWriteTime.dwHighDateTime=0x1d4d39c, nFileSizeHigh=0x0, nFileSizeLow=0x9639, dwReserved0=0x5e, dwReserved1=0x0, cFileName="pIS9JaYO3meJ733a.m4a", cAlternateFileName="PIS9JA~1.M4A")) returned 1 [0034.984] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c99be00, ftCreationTime.dwHighDateTime=0x1d4c804, ftLastAccessTime.dwLowDateTime=0x84e19da0, ftLastAccessTime.dwHighDateTime=0x1d4ca06, ftLastWriteTime.dwLowDateTime=0x84e19da0, ftLastWriteTime.dwHighDateTime=0x1d4ca06, nFileSizeHigh=0x0, nFileSizeLow=0x181c9, dwReserved0=0x5e, dwReserved1=0x0, cFileName="XvqWYaAAFozS.wav", cAlternateFileName="XVQWYA~1.WAV")) returned 1 [0034.984] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c99be00, ftCreationTime.dwHighDateTime=0x1d4c804, ftLastAccessTime.dwLowDateTime=0x84e19da0, ftLastAccessTime.dwHighDateTime=0x1d4ca06, ftLastWriteTime.dwLowDateTime=0x84e19da0, ftLastWriteTime.dwHighDateTime=0x1d4ca06, nFileSizeHigh=0x0, nFileSizeLow=0x181c9, dwReserved0=0x5e, dwReserved1=0x0, cFileName="XvqWYaAAFozS.wav", cAlternateFileName="XVQWYA~1.WAV")) returned 0 [0034.984] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.984] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46969e10, ftCreationTime.dwHighDateTime=0x1d4d546, ftLastAccessTime.dwLowDateTime=0x3328b8a0, ftLastAccessTime.dwHighDateTime=0x1d4c596, ftLastWriteTime.dwLowDateTime=0x3328b8a0, ftLastWriteTime.dwHighDateTime=0x1d4c596, nFileSizeHigh=0x0, nFileSizeLow=0xd835, dwReserved0=0x61772e53, dwReserved1=0x346d2e76, cFileName="XUD6Ym8ZydDIAh.wav", cAlternateFileName="XUD6YM~1.WAV")) returned 1 [0034.984] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46969e10, ftCreationTime.dwHighDateTime=0x1d4d546, ftLastAccessTime.dwLowDateTime=0x3328b8a0, ftLastAccessTime.dwHighDateTime=0x1d4c596, ftLastWriteTime.dwLowDateTime=0x3328b8a0, ftLastWriteTime.dwHighDateTime=0x1d4c596, nFileSizeHigh=0x0, nFileSizeLow=0xd835, dwReserved0=0x61772e53, dwReserved1=0x346d2e76, cFileName="XUD6Ym8ZydDIAh.wav", cAlternateFileName="XUD6YM~1.WAV")) returned 0 [0034.984] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0034.984] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61766177, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0034.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46969e10, ftCreationTime.dwHighDateTime=0x1d4d546, ftLastAccessTime.dwLowDateTime=0x3328b8a0, ftLastAccessTime.dwHighDateTime=0x1d4c596, ftLastWriteTime.dwLowDateTime=0x3328b8a0, ftLastWriteTime.dwHighDateTime=0x1d4c596, nFileSizeHigh=0x0, nFileSizeLow=0xd835, dwReserved0=0x61772e53, dwReserved1=0x346d2e76, cFileName="XUD6Ym8ZydDIAh.wav", cAlternateFileName="\xb0\x4c\x5c")) returned 0xffffffff [0034.984] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61766177, cFileName="NetHood", cAlternateFileName="")) returned 1 [0034.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46969e10, ftCreationTime.dwHighDateTime=0x1d4d546, ftLastAccessTime.dwLowDateTime=0x3328b8a0, ftLastAccessTime.dwHighDateTime=0x1d4c596, ftLastWriteTime.dwLowDateTime=0x3328b8a0, ftLastWriteTime.dwHighDateTime=0x1d4c596, nFileSizeHigh=0x0, nFileSizeLow=0xd835, dwReserved0=0x61772e53, dwReserved1=0x346d2e76, cFileName="XUD6Ym8ZydDIAh.wav", cAlternateFileName="\xb0\x4c\x5c")) returned 0xffffffff [0034.985] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x61766177, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0034.985] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x61766177, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0034.985] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61766177, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0034.985] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x61766177, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0034.985] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x61766177, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0034.985] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x61766177, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0034.985] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x61766177, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0034.985] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini")) returned 0x6 [0034.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0034.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0034.986] ReadFile (in: hFile=0xe8, lpBuffer=0x18d8c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d614, lpOverlapped=0x0 | out: lpBuffer=0x18d8c8*, lpNumberOfBytesRead=0x18d614*=0x14, lpOverlapped=0x0) returned 1 [0034.987] WriteFile (in: hFile=0xf8, lpBuffer=0x18e8c8*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x18d614, lpOverlapped=0x0 | out: lpBuffer=0x18e8c8*, lpNumberOfBytesWritten=0x18d614*=0x14, lpOverlapped=0x0) returned 1 [0034.987] ReadFile (in: hFile=0xe8, lpBuffer=0x18d8c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d614, lpOverlapped=0x0 | out: lpBuffer=0x18d8c8*, lpNumberOfBytesRead=0x18d614*=0x0, lpOverlapped=0x0) returned 1 [0034.987] WriteFile (in: hFile=0xf8, lpBuffer=0x18e8c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d614, lpOverlapped=0x0 | out: lpBuffer=0x18e8c8*, lpNumberOfBytesWritten=0x18d614*=0x0, lpOverlapped=0x0) returned 1 [0034.988] CloseHandle (hObject=0xe8) returned 1 [0034.988] CloseHandle (hObject=0xf8) returned 1 [0034.988] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini.crypt")) returned 0 [0034.988] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini.crypt")) returned 0x20 [0034.988] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini", lpFindFileData=0x18f764 | out: lpFindFileData=0x18f764*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="ntuser.ini", cAlternateFileName="")) returned 0x5c8e80 [0034.988] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f764 | out: lpFindFileData=0x18f764*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="ntuser.ini", cAlternateFileName="")) returned 0 [0034.988] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0034.988] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini")) returned 1 [0034.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\ntuser.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\ntuser.ini")) returned 0xffffffff [0034.989] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9515a240, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9515a240, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f874, cFileName="Pictures", cAlternateFileName="")) returned 1 [0034.989] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9515a240, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9515a240, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0034.989] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9515a240, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9515a240, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x50, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.989] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39b64f0, ftCreationTime.dwHighDateTime=0x1d4d0c4, ftLastAccessTime.dwLowDateTime=0x552bd9f0, ftLastAccessTime.dwHighDateTime=0x1d4c708, ftLastWriteTime.dwLowDateTime=0x552bd9f0, ftLastWriteTime.dwHighDateTime=0x1d4c708, nFileSizeHigh=0x0, nFileSizeLow=0x8f45, dwReserved0=0x50, dwReserved1=0x0, cFileName="1k4R.gif", cAlternateFileName="")) returned 1 [0034.989] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbbdb960, ftCreationTime.dwHighDateTime=0x1d4ca4e, ftLastAccessTime.dwLowDateTime=0x43dde5d0, ftLastAccessTime.dwHighDateTime=0x1d4cc76, ftLastWriteTime.dwLowDateTime=0x43dde5d0, ftLastWriteTime.dwHighDateTime=0x1d4cc76, nFileSizeHigh=0x0, nFileSizeLow=0x108e9, dwReserved0=0x50, dwReserved1=0x0, cFileName="7pxElmPL-Wwhu0MBGln.bmp", cAlternateFileName="7PXELM~1.BMP")) returned 1 [0034.989] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d4b15a0, ftCreationTime.dwHighDateTime=0x1d4d18c, ftLastAccessTime.dwLowDateTime=0x43012fd0, ftLastAccessTime.dwHighDateTime=0x1d4cd86, ftLastWriteTime.dwLowDateTime=0x43012fd0, ftLastWriteTime.dwHighDateTime=0x1d4cd86, nFileSizeHigh=0x0, nFileSizeLow=0x121a8, dwReserved0=0x50, dwReserved1=0x0, cFileName="czX2gsVPMSP9d.png", cAlternateFileName="CZX2GS~1.PNG")) returned 1 [0034.989] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\czX2gsVPMSP9d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\czx2gsvpmsp9d.png")) returned 0x20 [0034.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\czX2gsVPMSP9d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\czx2gsvpmsp9d.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0034.990] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\czX2gsVPMSP9d.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\czx2gsvpmsp9d.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0034.990] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.991] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.992] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.992] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.992] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.992] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.992] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.992] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.992] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.993] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.993] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.993] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.993] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.993] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.993] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.994] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.994] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.994] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.994] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.994] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.994] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.994] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.995] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.995] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.995] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.995] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.995] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.995] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.995] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.996] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.996] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.996] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.996] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.996] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.996] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.996] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0034.997] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1a8, lpOverlapped=0x0) returned 1 [0034.997] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1a8, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1a8, lpOverlapped=0x0) returned 1 [0034.997] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.997] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0034.997] CloseHandle (hObject=0xe8) returned 1 [0034.997] CloseHandle (hObject=0xec) returned 1 [0034.997] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\czX2gsVPMSP9d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\czx2gsvpmsp9d.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\czX2gsVPMSP9d.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\czx2gsvpmsp9d.png.crypt")) returned 0 [0034.997] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\czX2gsVPMSP9d.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\czx2gsvpmsp9d.png.crypt")) returned 0x20 [0034.997] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\czX2gsVPMSP9d.png", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d4b15a0, ftCreationTime.dwHighDateTime=0x1d4d18c, ftLastAccessTime.dwLowDateTime=0x43012fd0, ftLastAccessTime.dwHighDateTime=0x1d4cd86, ftLastWriteTime.dwLowDateTime=0x43012fd0, ftLastWriteTime.dwHighDateTime=0x1d4cd86, nFileSizeHigh=0x0, nFileSizeLow=0x121a8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="czX2gsVPMSP9d.png", cAlternateFileName="CZX2GS~1.PNG")) returned 0x5c8ec0 [0034.997] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d4b15a0, ftCreationTime.dwHighDateTime=0x1d4d18c, ftLastAccessTime.dwLowDateTime=0x43012fd0, ftLastAccessTime.dwHighDateTime=0x1d4cd86, ftLastWriteTime.dwLowDateTime=0x43012fd0, ftLastWriteTime.dwHighDateTime=0x1d4cd86, nFileSizeHigh=0x0, nFileSizeLow=0x121a8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="czX2gsVPMSP9d.png", cAlternateFileName="CZX2GS~1.PNG")) returned 0 [0034.997] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0034.998] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\czX2gsVPMSP9d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\czx2gsvpmsp9d.png")) returned 1 [0034.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\czX2gsVPMSP9d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\czx2gsvpmsp9d.png")) returned 0xffffffff [0034.999] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0034.999] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini")) returned 0x26 [0034.999] VirtualAlloc (lpAddress=0x31d8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31d8000 [0034.999] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.000] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.001] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1f8, lpOverlapped=0x0) returned 1 [0035.001] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1f8, lpOverlapped=0x0) returned 1 [0035.002] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.002] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.002] CloseHandle (hObject=0xec) returned 1 [0035.002] CloseHandle (hObject=0xe8) returned 1 [0035.003] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini.crypt")) returned 0 [0035.003] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini.crypt")) returned 0x20 [0035.003] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0035.003] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0035.003] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.003] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini")) returned 1 [0035.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\desktop.ini")) returned 0xffffffff [0035.004] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197dbb20, ftCreationTime.dwHighDateTime=0x1d4cec0, ftLastAccessTime.dwLowDateTime=0x2751a9e0, ftLastAccessTime.dwHighDateTime=0x1d4ce17, ftLastWriteTime.dwLowDateTime=0x2751a9e0, ftLastWriteTime.dwHighDateTime=0x1d4ce17, nFileSizeHigh=0x0, nFileSizeLow=0x1289c, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Dg3vL1ig5.png", cAlternateFileName="DG3VL1~1.PNG")) returned 1 [0035.004] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Dg3vL1ig5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dg3vl1ig5.png")) returned 0x20 [0035.004] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Dg3vL1ig5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dg3vl1ig5.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.004] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Dg3vL1ig5.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dg3vl1ig5.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.005] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.005] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.006] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.006] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.007] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.007] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.007] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.007] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.007] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.007] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.007] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.008] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.008] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.008] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.008] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.008] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.008] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.009] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.009] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.009] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.009] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.009] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.009] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.009] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.010] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.010] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.010] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.010] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.010] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.010] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.010] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.011] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.011] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.011] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.011] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.011] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.011] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x89c, lpOverlapped=0x0) returned 1 [0035.011] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x89c, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x89c, lpOverlapped=0x0) returned 1 [0035.011] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.012] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.012] CloseHandle (hObject=0xe8) returned 1 [0035.012] CloseHandle (hObject=0xec) returned 1 [0035.012] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Dg3vL1ig5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dg3vl1ig5.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Dg3vL1ig5.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dg3vl1ig5.png.crypt")) returned 0 [0035.012] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Dg3vL1ig5.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dg3vl1ig5.png.crypt")) returned 0x20 [0035.012] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Dg3vL1ig5.png", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197dbb20, ftCreationTime.dwHighDateTime=0x1d4cec0, ftLastAccessTime.dwLowDateTime=0x2751a9e0, ftLastAccessTime.dwHighDateTime=0x1d4ce17, ftLastWriteTime.dwLowDateTime=0x2751a9e0, ftLastWriteTime.dwHighDateTime=0x1d4ce17, nFileSizeHigh=0x0, nFileSizeLow=0x1289c, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Dg3vL1ig5.png", cAlternateFileName="DG3VL1~1.PNG")) returned 0x5c8ec0 [0035.012] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x197dbb20, ftCreationTime.dwHighDateTime=0x1d4cec0, ftLastAccessTime.dwLowDateTime=0x2751a9e0, ftLastAccessTime.dwHighDateTime=0x1d4ce17, ftLastWriteTime.dwLowDateTime=0x2751a9e0, ftLastWriteTime.dwHighDateTime=0x1d4ce17, nFileSizeHigh=0x0, nFileSizeLow=0x1289c, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Dg3vL1ig5.png", cAlternateFileName="DG3VL1~1.PNG")) returned 0 [0035.012] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.012] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Dg3vL1ig5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dg3vl1ig5.png")) returned 1 [0035.014] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Dg3vL1ig5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\dg3vl1ig5.png")) returned 0xffffffff [0035.014] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ef19650, ftCreationTime.dwHighDateTime=0x1d4cc5a, ftLastAccessTime.dwLowDateTime=0x4d3a6ef0, ftLastAccessTime.dwHighDateTime=0x1d4c677, ftLastWriteTime.dwLowDateTime=0x4d3a6ef0, ftLastWriteTime.dwHighDateTime=0x1d4c677, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="EbgPE9V15_kcIv3u6EhR", cAlternateFileName="EBGPE9~1")) returned 1 [0035.014] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ef19650, ftCreationTime.dwHighDateTime=0x1d4cc5a, ftLastAccessTime.dwLowDateTime=0x4d3a6ef0, ftLastAccessTime.dwHighDateTime=0x1d4c677, ftLastWriteTime.dwLowDateTime=0x4d3a6ef0, ftLastWriteTime.dwHighDateTime=0x1d4c677, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0035.014] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ef19650, ftCreationTime.dwHighDateTime=0x1d4cc5a, ftLastAccessTime.dwLowDateTime=0x4d3a6ef0, ftLastAccessTime.dwHighDateTime=0x1d4c677, ftLastWriteTime.dwLowDateTime=0x4d3a6ef0, ftLastWriteTime.dwHighDateTime=0x1d4c677, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.014] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47873810, ftCreationTime.dwHighDateTime=0x1d4d2b3, ftLastAccessTime.dwLowDateTime=0x2965b60, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0x2965b60, ftLastWriteTime.dwHighDateTime=0x1d4d0a0, nFileSizeHigh=0x0, nFileSizeLow=0xa5c0, dwReserved0=0x68, dwReserved1=0x0, cFileName="2YTf5ryi8j8c45B6Xqk1.png", cAlternateFileName="2YTF5R~1.PNG")) returned 1 [0035.014] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\2YTf5ryi8j8c45B6Xqk1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\2ytf5ryi8j8c45b6xqk1.png")) returned 0x20 [0035.014] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\2YTf5ryi8j8c45B6Xqk1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\2ytf5ryi8j8c45b6xqk1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.015] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\2YTf5ryi8j8c45B6Xqk1.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\2ytf5ryi8j8c45b6xqk1.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0035.015] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.016] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.017] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.017] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.017] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.018] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.018] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.018] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.018] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.018] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.018] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.018] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.019] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.019] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.019] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.019] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.019] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.019] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.019] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.020] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.020] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x5c0, lpOverlapped=0x0) returned 1 [0035.020] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x5c0, lpOverlapped=0x0) returned 1 [0035.020] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.020] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.020] CloseHandle (hObject=0xe8) returned 1 [0035.020] CloseHandle (hObject=0x114) returned 1 [0035.020] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\2YTf5ryi8j8c45B6Xqk1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\2ytf5ryi8j8c45b6xqk1.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\2YTf5ryi8j8c45B6Xqk1.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\2ytf5ryi8j8c45b6xqk1.png.crypt")) returned 0 [0035.020] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\2YTf5ryi8j8c45B6Xqk1.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\2ytf5ryi8j8c45b6xqk1.png.crypt")) returned 0x20 [0035.021] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\2YTf5ryi8j8c45B6Xqk1.png", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47873810, ftCreationTime.dwHighDateTime=0x1d4d2b3, ftLastAccessTime.dwLowDateTime=0x2965b60, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0x2965b60, ftLastWriteTime.dwHighDateTime=0x1d4d0a0, nFileSizeHigh=0x0, nFileSizeLow=0xa5c0, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="2YTf5ryi8j8c45B6Xqk1.png", cAlternateFileName="2YTF5R~1.PNG")) returned 0x5c8f00 [0035.021] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47873810, ftCreationTime.dwHighDateTime=0x1d4d2b3, ftLastAccessTime.dwLowDateTime=0x2965b60, ftLastAccessTime.dwHighDateTime=0x1d4d0a0, ftLastWriteTime.dwLowDateTime=0x2965b60, ftLastWriteTime.dwHighDateTime=0x1d4d0a0, nFileSizeHigh=0x0, nFileSizeLow=0xa5c0, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="2YTf5ryi8j8c45B6Xqk1.png", cAlternateFileName="2YTF5R~1.PNG")) returned 0 [0035.021] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.021] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\2YTf5ryi8j8c45B6Xqk1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\2ytf5ryi8j8c45b6xqk1.png")) returned 1 [0035.022] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\2YTf5ryi8j8c45B6Xqk1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\2ytf5ryi8j8c45b6xqk1.png")) returned 0xffffffff [0035.022] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34e96770, ftCreationTime.dwHighDateTime=0x1d4d518, ftLastAccessTime.dwLowDateTime=0x82566ed0, ftLastAccessTime.dwHighDateTime=0x1d4c538, ftLastWriteTime.dwLowDateTime=0x82566ed0, ftLastWriteTime.dwHighDateTime=0x1d4c538, nFileSizeHigh=0x0, nFileSizeLow=0x3b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dl_7dNsKCTJ_j79tbg8.png", cAlternateFileName="DL_7DN~1.PNG")) returned 1 [0035.022] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\Dl_7dNsKCTJ_j79tbg8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\dl_7dnskctj_j79tbg8.png")) returned 0x20 [0035.022] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\Dl_7dNsKCTJ_j79tbg8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\dl_7dnskctj_j79tbg8.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0035.023] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\Dl_7dNsKCTJ_j79tbg8.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\dl_7dnskctj_j79tbg8.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.023] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.024] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.024] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.025] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.025] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.025] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.025] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xb38, lpOverlapped=0x0) returned 1 [0035.025] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xb38, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xb38, lpOverlapped=0x0) returned 1 [0035.025] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.025] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.025] CloseHandle (hObject=0x114) returned 1 [0035.025] CloseHandle (hObject=0xe8) returned 1 [0035.026] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\Dl_7dNsKCTJ_j79tbg8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\dl_7dnskctj_j79tbg8.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\Dl_7dNsKCTJ_j79tbg8.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\dl_7dnskctj_j79tbg8.png.crypt")) returned 0 [0035.026] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\Dl_7dNsKCTJ_j79tbg8.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\dl_7dnskctj_j79tbg8.png.crypt")) returned 0x20 [0035.026] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\Dl_7dNsKCTJ_j79tbg8.png", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34e96770, ftCreationTime.dwHighDateTime=0x1d4d518, ftLastAccessTime.dwLowDateTime=0x82566ed0, ftLastAccessTime.dwHighDateTime=0x1d4c538, ftLastWriteTime.dwLowDateTime=0x82566ed0, ftLastWriteTime.dwHighDateTime=0x1d4c538, nFileSizeHigh=0x0, nFileSizeLow=0x3b38, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Dl_7dNsKCTJ_j79tbg8.png", cAlternateFileName="DL_7DN~1.PNG")) returned 0x5c8f00 [0035.026] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34e96770, ftCreationTime.dwHighDateTime=0x1d4d518, ftLastAccessTime.dwLowDateTime=0x82566ed0, ftLastAccessTime.dwHighDateTime=0x1d4c538, ftLastWriteTime.dwLowDateTime=0x82566ed0, ftLastWriteTime.dwHighDateTime=0x1d4c538, nFileSizeHigh=0x0, nFileSizeLow=0x3b38, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Dl_7dNsKCTJ_j79tbg8.png", cAlternateFileName="DL_7DN~1.PNG")) returned 0 [0035.026] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.026] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\Dl_7dNsKCTJ_j79tbg8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\dl_7dnskctj_j79tbg8.png")) returned 1 [0035.027] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\Dl_7dNsKCTJ_j79tbg8.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\dl_7dnskctj_j79tbg8.png")) returned 0xffffffff [0035.027] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x503f4340, ftCreationTime.dwHighDateTime=0x1d4d127, ftLastAccessTime.dwLowDateTime=0xb1e9d910, ftLastAccessTime.dwHighDateTime=0x1d4d44d, ftLastWriteTime.dwLowDateTime=0xb1e9d910, ftLastWriteTime.dwHighDateTime=0x1d4d44d, nFileSizeHigh=0x0, nFileSizeLow=0xd1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="grU9T.gif", cAlternateFileName="")) returned 1 [0035.027] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa95e4890, ftCreationTime.dwHighDateTime=0x1d4d159, ftLastAccessTime.dwLowDateTime=0x21dfd860, ftLastAccessTime.dwHighDateTime=0x1d4d1b9, ftLastWriteTime.dwLowDateTime=0x21dfd860, ftLastWriteTime.dwHighDateTime=0x1d4d1b9, nFileSizeHigh=0x0, nFileSizeLow=0x124df, dwReserved0=0x0, dwReserved1=0x0, cFileName="hG7YH.png", cAlternateFileName="")) returned 1 [0035.027] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\hG7YH.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\hg7yh.png")) returned 0x20 [0035.028] VirtualAlloc (lpAddress=0x31dc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31dc000 [0035.028] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\hG7YH.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\hg7yh.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.028] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\hG7YH.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\hg7yh.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0035.028] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.029] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.030] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.030] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.030] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.031] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.031] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.031] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.031] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.031] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.031] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.032] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.032] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.032] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.032] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.032] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.032] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.032] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.033] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.033] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.033] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.033] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.033] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.033] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.033] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.034] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.034] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.034] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.034] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.034] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.034] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.034] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.035] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.035] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.035] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.035] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.035] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x4df, lpOverlapped=0x0) returned 1 [0035.035] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x4df, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x4df, lpOverlapped=0x0) returned 1 [0035.035] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.035] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.036] CloseHandle (hObject=0xe8) returned 1 [0035.036] CloseHandle (hObject=0x114) returned 1 [0035.036] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\hG7YH.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\hg7yh.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\hG7YH.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\hg7yh.png.crypt")) returned 0 [0035.036] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\hG7YH.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\hg7yh.png.crypt")) returned 0x20 [0035.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\hG7YH.png", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa95e4890, ftCreationTime.dwHighDateTime=0x1d4d159, ftLastAccessTime.dwLowDateTime=0x21dfd860, ftLastAccessTime.dwHighDateTime=0x1d4d1b9, ftLastWriteTime.dwLowDateTime=0x21dfd860, ftLastWriteTime.dwHighDateTime=0x1d4d1b9, nFileSizeHigh=0x0, nFileSizeLow=0x124df, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="hG7YH.png", cAlternateFileName="")) returned 0x5c8f00 [0035.036] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa95e4890, ftCreationTime.dwHighDateTime=0x1d4d159, ftLastAccessTime.dwLowDateTime=0x21dfd860, ftLastAccessTime.dwHighDateTime=0x1d4d1b9, ftLastWriteTime.dwLowDateTime=0x21dfd860, ftLastWriteTime.dwHighDateTime=0x1d4d1b9, nFileSizeHigh=0x0, nFileSizeLow=0x124df, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="hG7YH.png", cAlternateFileName="")) returned 0 [0035.036] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.036] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\hG7YH.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\hg7yh.png")) returned 1 [0035.038] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\hG7YH.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\hg7yh.png")) returned 0xffffffff [0035.038] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b68abd0, ftCreationTime.dwHighDateTime=0x1d4d5aa, ftLastAccessTime.dwLowDateTime=0x4b3ed390, ftLastAccessTime.dwHighDateTime=0x1d4d28c, ftLastWriteTime.dwLowDateTime=0x4b3ed390, ftLastWriteTime.dwHighDateTime=0x1d4d28c, nFileSizeHigh=0x0, nFileSizeLow=0xebc4, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="itujVDK1.png", cAlternateFileName="")) returned 1 [0035.038] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\itujVDK1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\itujvdk1.png")) returned 0x20 [0035.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\itujVDK1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\itujvdk1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0035.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\itujVDK1.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\itujvdk1.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.041] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.042] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.043] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.043] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.043] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.043] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.043] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.043] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.043] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.044] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.044] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.044] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.044] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.044] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.044] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.045] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.045] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.045] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.045] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.045] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.045] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.046] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.046] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.046] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.046] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.047] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.047] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.047] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.047] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xbc4, lpOverlapped=0x0) returned 1 [0035.047] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xbc4, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xbc4, lpOverlapped=0x0) returned 1 [0035.047] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.047] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.047] CloseHandle (hObject=0x114) returned 1 [0035.047] CloseHandle (hObject=0xe8) returned 1 [0035.047] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\itujVDK1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\itujvdk1.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\itujVDK1.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\itujvdk1.png.crypt")) returned 0 [0035.048] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\itujVDK1.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\itujvdk1.png.crypt")) returned 0x20 [0035.048] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\itujVDK1.png", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b68abd0, ftCreationTime.dwHighDateTime=0x1d4d5aa, ftLastAccessTime.dwLowDateTime=0x4b3ed390, ftLastAccessTime.dwHighDateTime=0x1d4d28c, ftLastWriteTime.dwLowDateTime=0x4b3ed390, ftLastWriteTime.dwHighDateTime=0x1d4d28c, nFileSizeHigh=0x0, nFileSizeLow=0xebc4, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="itujVDK1.png", cAlternateFileName="")) returned 0x5c8f00 [0035.048] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b68abd0, ftCreationTime.dwHighDateTime=0x1d4d5aa, ftLastAccessTime.dwLowDateTime=0x4b3ed390, ftLastAccessTime.dwHighDateTime=0x1d4d28c, ftLastWriteTime.dwLowDateTime=0x4b3ed390, ftLastWriteTime.dwHighDateTime=0x1d4d28c, nFileSizeHigh=0x0, nFileSizeLow=0xebc4, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="itujVDK1.png", cAlternateFileName="")) returned 0 [0035.048] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.048] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\itujVDK1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\itujvdk1.png")) returned 1 [0035.049] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\itujVDK1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\itujvdk1.png")) returned 0xffffffff [0035.050] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2055d5e0, ftCreationTime.dwHighDateTime=0x1d4ceac, ftLastAccessTime.dwLowDateTime=0x7db05b70, ftLastAccessTime.dwHighDateTime=0x1d4ceb1, ftLastWriteTime.dwLowDateTime=0x7db05b70, ftLastWriteTime.dwHighDateTime=0x1d4ceb1, nFileSizeHigh=0x0, nFileSizeLow=0x1142e, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="N0tyvu.bmp", cAlternateFileName="")) returned 1 [0035.050] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1603a350, ftCreationTime.dwHighDateTime=0x1d4d254, ftLastAccessTime.dwLowDateTime=0x79516f30, ftLastAccessTime.dwHighDateTime=0x1d4d2c4, ftLastWriteTime.dwLowDateTime=0x79516f30, ftLastWriteTime.dwHighDateTime=0x1d4d2c4, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="nOlSru49ZI7Mce.bmp", cAlternateFileName="NOLSRU~1.BMP")) returned 1 [0035.050] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f96860, ftCreationTime.dwHighDateTime=0x1d4c5e1, ftLastAccessTime.dwLowDateTime=0x3d5550a0, ftLastAccessTime.dwHighDateTime=0x1d4d12a, ftLastWriteTime.dwLowDateTime=0x3d5550a0, ftLastWriteTime.dwHighDateTime=0x1d4d12a, nFileSizeHigh=0x0, nFileSizeLow=0x435a, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="OSbShf5y0ZH.png", cAlternateFileName="OSBSHF~1.PNG")) returned 1 [0035.050] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\OSbShf5y0ZH.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\osbshf5y0zh.png")) returned 0x20 [0035.050] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\OSbShf5y0ZH.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\osbshf5y0zh.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.050] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\OSbShf5y0ZH.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\osbshf5y0zh.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0035.050] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.051] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.052] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.052] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.052] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.053] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.053] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.053] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.053] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x35a, lpOverlapped=0x0) returned 1 [0035.053] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x35a, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x35a, lpOverlapped=0x0) returned 1 [0035.053] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.053] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.053] CloseHandle (hObject=0xe8) returned 1 [0035.053] CloseHandle (hObject=0x114) returned 1 [0035.054] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\OSbShf5y0ZH.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\osbshf5y0zh.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\OSbShf5y0ZH.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\osbshf5y0zh.png.crypt")) returned 0 [0035.054] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\OSbShf5y0ZH.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\osbshf5y0zh.png.crypt")) returned 0x20 [0035.054] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\OSbShf5y0ZH.png", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f96860, ftCreationTime.dwHighDateTime=0x1d4c5e1, ftLastAccessTime.dwLowDateTime=0x3d5550a0, ftLastAccessTime.dwHighDateTime=0x1d4d12a, ftLastWriteTime.dwLowDateTime=0x3d5550a0, ftLastWriteTime.dwHighDateTime=0x1d4d12a, nFileSizeHigh=0x0, nFileSizeLow=0x435a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="OSbShf5y0ZH.png", cAlternateFileName="OSBSHF~1.PNG")) returned 0x5c8f00 [0035.054] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f96860, ftCreationTime.dwHighDateTime=0x1d4c5e1, ftLastAccessTime.dwLowDateTime=0x3d5550a0, ftLastAccessTime.dwHighDateTime=0x1d4d12a, ftLastWriteTime.dwLowDateTime=0x3d5550a0, ftLastWriteTime.dwHighDateTime=0x1d4d12a, nFileSizeHigh=0x0, nFileSizeLow=0x435a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="OSbShf5y0ZH.png", cAlternateFileName="OSBSHF~1.PNG")) returned 0 [0035.054] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.054] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\OSbShf5y0ZH.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\osbshf5y0zh.png")) returned 1 [0035.055] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\OSbShf5y0ZH.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\osbshf5y0zh.png")) returned 0xffffffff [0035.055] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f8bcb10, ftCreationTime.dwHighDateTime=0x1d4d4f3, ftLastAccessTime.dwLowDateTime=0x23bc48f0, ftLastAccessTime.dwHighDateTime=0x1d4c947, ftLastWriteTime.dwLowDateTime=0x23bc48f0, ftLastWriteTime.dwHighDateTime=0x1d4c947, nFileSizeHigh=0x0, nFileSizeLow=0x11fb8, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="QFEDUHr5Z.png", cAlternateFileName="QFEDUH~1.PNG")) returned 1 [0035.055] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\QFEDUHr5Z.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\qfeduhr5z.png")) returned 0x20 [0035.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\QFEDUHr5Z.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\qfeduhr5z.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0035.056] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\QFEDUHr5Z.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\qfeduhr5z.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.056] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.057] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.058] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.058] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.058] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.058] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.058] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.058] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.058] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.059] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.059] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.059] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.059] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.059] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.059] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.060] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.060] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.060] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.060] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.060] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.060] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.060] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.061] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.061] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.061] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.061] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.061] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.061] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.062] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.062] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.062] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.062] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.062] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.062] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.063] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xfb8, lpOverlapped=0x0) returned 1 [0035.063] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xfb8, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xfb8, lpOverlapped=0x0) returned 1 [0035.063] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.063] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.063] CloseHandle (hObject=0x114) returned 1 [0035.063] CloseHandle (hObject=0xe8) returned 1 [0035.063] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\QFEDUHr5Z.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\qfeduhr5z.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\QFEDUHr5Z.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\qfeduhr5z.png.crypt")) returned 0 [0035.063] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\QFEDUHr5Z.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\qfeduhr5z.png.crypt")) returned 0x20 [0035.063] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\QFEDUHr5Z.png", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f8bcb10, ftCreationTime.dwHighDateTime=0x1d4d4f3, ftLastAccessTime.dwLowDateTime=0x23bc48f0, ftLastAccessTime.dwHighDateTime=0x1d4c947, ftLastWriteTime.dwLowDateTime=0x23bc48f0, ftLastWriteTime.dwHighDateTime=0x1d4c947, nFileSizeHigh=0x0, nFileSizeLow=0x11fb8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="QFEDUHr5Z.png", cAlternateFileName="QFEDUH~1.PNG")) returned 0x5c8f00 [0035.064] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f8bcb10, ftCreationTime.dwHighDateTime=0x1d4d4f3, ftLastAccessTime.dwLowDateTime=0x23bc48f0, ftLastAccessTime.dwHighDateTime=0x1d4c947, ftLastWriteTime.dwLowDateTime=0x23bc48f0, ftLastWriteTime.dwHighDateTime=0x1d4c947, nFileSizeHigh=0x0, nFileSizeLow=0x11fb8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="QFEDUHr5Z.png", cAlternateFileName="QFEDUH~1.PNG")) returned 0 [0035.064] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.064] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\QFEDUHr5Z.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\qfeduhr5z.png")) returned 1 [0035.065] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\QFEDUHr5Z.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\qfeduhr5z.png")) returned 0xffffffff [0035.065] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1750f40, ftCreationTime.dwHighDateTime=0x1d4d345, ftLastAccessTime.dwLowDateTime=0x26f73100, ftLastAccessTime.dwHighDateTime=0x1d4c939, ftLastWriteTime.dwLowDateTime=0x26f73100, ftLastWriteTime.dwHighDateTime=0x1d4c939, nFileSizeHigh=0x0, nFileSizeLow=0x11837, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="tlYEuU.jpg", cAlternateFileName="")) returned 1 [0035.065] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\tlYEuU.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\tlyeuu.jpg")) returned 0x20 [0035.065] VirtualAlloc (lpAddress=0x31e0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31e0000 [0035.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\tlYEuU.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\tlyeuu.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\tlYEuU.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\tlyeuu.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0035.066] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.067] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.068] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.068] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.068] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.069] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.069] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.069] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.069] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.069] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.069] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.069] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.070] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.070] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.070] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.070] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.070] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.070] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.070] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.071] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.071] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.071] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.071] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.071] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.071] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.071] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.072] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.072] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.072] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.072] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.072] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.072] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.072] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.073] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.073] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x837, lpOverlapped=0x0) returned 1 [0035.073] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x837, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x837, lpOverlapped=0x0) returned 1 [0035.073] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.073] WriteFile (in: hFile=0x114, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.073] CloseHandle (hObject=0xe8) returned 1 [0035.073] CloseHandle (hObject=0x114) returned 1 [0035.073] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\tlYEuU.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\tlyeuu.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\tlYEuU.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\tlyeuu.jpg.crypt")) returned 0 [0035.074] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\tlYEuU.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\tlyeuu.jpg.crypt")) returned 0x20 [0035.074] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\tlYEuU.jpg", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1750f40, ftCreationTime.dwHighDateTime=0x1d4d345, ftLastAccessTime.dwLowDateTime=0x26f73100, ftLastAccessTime.dwHighDateTime=0x1d4c939, ftLastWriteTime.dwLowDateTime=0x26f73100, ftLastWriteTime.dwHighDateTime=0x1d4c939, nFileSizeHigh=0x0, nFileSizeLow=0x11837, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="tlYEuU.jpg", cAlternateFileName="")) returned 0x5c8f00 [0035.074] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1750f40, ftCreationTime.dwHighDateTime=0x1d4d345, ftLastAccessTime.dwLowDateTime=0x26f73100, ftLastAccessTime.dwHighDateTime=0x1d4c939, ftLastWriteTime.dwLowDateTime=0x26f73100, ftLastWriteTime.dwHighDateTime=0x1d4c939, nFileSizeHigh=0x0, nFileSizeLow=0x11837, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="tlYEuU.jpg", cAlternateFileName="")) returned 0 [0035.074] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.074] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\tlYEuU.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\tlyeuu.jpg")) returned 1 [0035.100] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\tlYEuU.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\tlyeuu.jpg")) returned 0xffffffff [0035.100] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b3dc130, ftCreationTime.dwHighDateTime=0x1d4d1d3, ftLastAccessTime.dwLowDateTime=0xf1fb0410, ftLastAccessTime.dwHighDateTime=0x1d4ca49, ftLastWriteTime.dwLowDateTime=0xf1fb0410, ftLastWriteTime.dwHighDateTime=0x1d4ca49, nFileSizeHigh=0x0, nFileSizeLow=0x7ba2, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="tMuxzgPEV.gif", cAlternateFileName="TMUXZG~1.GIF")) returned 1 [0035.100] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddd84bc0, ftCreationTime.dwHighDateTime=0x1d4ce5c, ftLastAccessTime.dwLowDateTime=0xa5c51bc0, ftLastAccessTime.dwHighDateTime=0x1d4d297, ftLastWriteTime.dwLowDateTime=0xa5c51bc0, ftLastWriteTime.dwHighDateTime=0x1d4d297, nFileSizeHigh=0x0, nFileSizeLow=0x7a6b, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="WPT7UafYBGl.jpg", cAlternateFileName="WPT7UA~1.JPG")) returned 1 [0035.100] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\WPT7UafYBGl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\wpt7uafybgl.jpg")) returned 0x20 [0035.101] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\WPT7UafYBGl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\wpt7uafybgl.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0035.101] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\WPT7UafYBGl.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\wpt7uafybgl.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.101] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.102] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.103] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.103] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.103] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.104] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.104] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.104] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.104] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.104] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.104] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.105] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.105] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.105] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0035.105] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xa6b, lpOverlapped=0x0) returned 1 [0035.105] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xa6b, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xa6b, lpOverlapped=0x0) returned 1 [0035.105] ReadFile (in: hFile=0x114, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.105] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0035.105] CloseHandle (hObject=0x114) returned 1 [0035.105] CloseHandle (hObject=0xe8) returned 1 [0035.105] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\WPT7UafYBGl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\wpt7uafybgl.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\WPT7UafYBGl.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\wpt7uafybgl.jpg.crypt")) returned 0 [0035.106] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\WPT7UafYBGl.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\wpt7uafybgl.jpg.crypt")) returned 0x20 [0035.106] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\WPT7UafYBGl.jpg", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddd84bc0, ftCreationTime.dwHighDateTime=0x1d4ce5c, ftLastAccessTime.dwLowDateTime=0xa5c51bc0, ftLastAccessTime.dwHighDateTime=0x1d4d297, ftLastWriteTime.dwLowDateTime=0xa5c51bc0, ftLastWriteTime.dwHighDateTime=0x1d4d297, nFileSizeHigh=0x0, nFileSizeLow=0x7a6b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="WPT7UafYBGl.jpg", cAlternateFileName="WPT7UA~1.JPG")) returned 0x5c8f00 [0035.106] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddd84bc0, ftCreationTime.dwHighDateTime=0x1d4ce5c, ftLastAccessTime.dwLowDateTime=0xa5c51bc0, ftLastAccessTime.dwHighDateTime=0x1d4d297, ftLastWriteTime.dwLowDateTime=0xa5c51bc0, ftLastWriteTime.dwHighDateTime=0x1d4d297, nFileSizeHigh=0x0, nFileSizeLow=0x7a6b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="WPT7UafYBGl.jpg", cAlternateFileName="WPT7UA~1.JPG")) returned 0 [0035.106] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.106] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\WPT7UafYBGl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\wpt7uafybgl.jpg")) returned 1 [0035.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\WPT7UafYBGl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\wpt7uafybgl.jpg")) returned 0xffffffff [0035.107] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5faf350, ftCreationTime.dwHighDateTime=0x1d4c602, ftLastAccessTime.dwLowDateTime=0xb25aed40, ftLastAccessTime.dwHighDateTime=0x1d4c97f, ftLastWriteTime.dwLowDateTime=0xb25aed40, ftLastWriteTime.dwHighDateTime=0x1d4c97f, nFileSizeHigh=0x0, nFileSizeLow=0x136af, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="zGYsNXFxx3.bmp", cAlternateFileName="ZGYSNX~1.BMP")) returned 1 [0035.107] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5faf350, ftCreationTime.dwHighDateTime=0x1d4c602, ftLastAccessTime.dwLowDateTime=0xb25aed40, ftLastAccessTime.dwHighDateTime=0x1d4c97f, ftLastWriteTime.dwLowDateTime=0xb25aed40, ftLastWriteTime.dwHighDateTime=0x1d4c97f, nFileSizeHigh=0x0, nFileSizeLow=0x136af, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="zGYsNXFxx3.bmp", cAlternateFileName="ZGYSNX~1.BMP")) returned 0 [0035.107] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.107] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508e6150, ftCreationTime.dwHighDateTime=0x1d4d1ae, ftLastAccessTime.dwLowDateTime=0x7681ee60, ftLastAccessTime.dwHighDateTime=0x1d4d4db, ftLastWriteTime.dwLowDateTime=0x7681ee60, ftLastWriteTime.dwHighDateTime=0x1d4d4db, nFileSizeHigh=0x0, nFileSizeLow=0x7d5c, dwReserved0=0x67706d62, dwReserved1=0x38706d62, cFileName="eovezfgn1Aazt5.png", cAlternateFileName="EOVEZF~1.PNG")) returned 1 [0035.107] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eovezfgn1Aazt5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eovezfgn1aazt5.png")) returned 0x20 [0035.108] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eovezfgn1Aazt5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eovezfgn1aazt5.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.108] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eovezfgn1Aazt5.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eovezfgn1aazt5.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.108] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.109] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.110] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.110] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.110] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.110] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.110] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.110] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.111] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.111] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.111] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.111] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.111] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.111] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.111] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0xd5c, lpOverlapped=0x0) returned 1 [0035.112] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0xd5c, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0xd5c, lpOverlapped=0x0) returned 1 [0035.112] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.112] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.112] CloseHandle (hObject=0xec) returned 1 [0035.112] CloseHandle (hObject=0xe8) returned 1 [0035.112] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eovezfgn1Aazt5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eovezfgn1aazt5.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eovezfgn1Aazt5.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eovezfgn1aazt5.png.crypt")) returned 0 [0035.112] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eovezfgn1Aazt5.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eovezfgn1aazt5.png.crypt")) returned 0x20 [0035.112] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eovezfgn1Aazt5.png", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508e6150, ftCreationTime.dwHighDateTime=0x1d4d1ae, ftLastAccessTime.dwLowDateTime=0x7681ee60, ftLastAccessTime.dwHighDateTime=0x1d4d4db, ftLastWriteTime.dwLowDateTime=0x7681ee60, ftLastWriteTime.dwHighDateTime=0x1d4d4db, nFileSizeHigh=0x0, nFileSizeLow=0x7d5c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="eovezfgn1Aazt5.png", cAlternateFileName="EOVEZF~1.PNG")) returned 0x5c8ec0 [0035.112] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508e6150, ftCreationTime.dwHighDateTime=0x1d4d1ae, ftLastAccessTime.dwLowDateTime=0x7681ee60, ftLastAccessTime.dwHighDateTime=0x1d4d4db, ftLastWriteTime.dwLowDateTime=0x7681ee60, ftLastWriteTime.dwHighDateTime=0x1d4d4db, nFileSizeHigh=0x0, nFileSizeLow=0x7d5c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="eovezfgn1Aazt5.png", cAlternateFileName="EOVEZF~1.PNG")) returned 0 [0035.113] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.113] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eovezfgn1Aazt5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eovezfgn1aazt5.png")) returned 1 [0035.114] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eovezfgn1Aazt5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eovezfgn1aazt5.png")) returned 0xffffffff [0035.114] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dad7c40, ftCreationTime.dwHighDateTime=0x1d4cbcc, ftLastAccessTime.dwLowDateTime=0xfdf78a60, ftLastAccessTime.dwHighDateTime=0x1d4cee8, ftLastWriteTime.dwLowDateTime=0xfdf78a60, ftLastWriteTime.dwHighDateTime=0x1d4cee8, nFileSizeHigh=0x0, nFileSizeLow=0x129a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="fp6DzYig6j9.png", cAlternateFileName="FP6DZY~1.PNG")) returned 1 [0035.114] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fp6DzYig6j9.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fp6dzyig6j9.png")) returned 0x20 [0035.114] VirtualAlloc (lpAddress=0x31e4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31e4000 [0035.115] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fp6DzYig6j9.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fp6dzyig6j9.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.115] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fp6DzYig6j9.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fp6dzyig6j9.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.115] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.116] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.117] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.117] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.117] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.117] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.117] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.117] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.117] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.118] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.118] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.118] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.118] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.118] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.118] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.119] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.119] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.119] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.119] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.119] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.119] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.119] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.120] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.120] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.120] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.120] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.120] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.120] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.120] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.121] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.121] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.121] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.121] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.121] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.121] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.121] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.122] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x9a2, lpOverlapped=0x0) returned 1 [0035.122] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x9a2, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x9a2, lpOverlapped=0x0) returned 1 [0035.122] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.122] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.122] CloseHandle (hObject=0xe8) returned 1 [0035.122] CloseHandle (hObject=0xec) returned 1 [0035.122] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fp6DzYig6j9.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fp6dzyig6j9.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fp6DzYig6j9.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fp6dzyig6j9.png.crypt")) returned 0 [0035.122] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fp6DzYig6j9.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fp6dzyig6j9.png.crypt")) returned 0x20 [0035.122] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fp6DzYig6j9.png", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dad7c40, ftCreationTime.dwHighDateTime=0x1d4cbcc, ftLastAccessTime.dwLowDateTime=0xfdf78a60, ftLastAccessTime.dwHighDateTime=0x1d4cee8, ftLastWriteTime.dwLowDateTime=0xfdf78a60, ftLastWriteTime.dwHighDateTime=0x1d4cee8, nFileSizeHigh=0x0, nFileSizeLow=0x129a2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="fp6DzYig6j9.png", cAlternateFileName="FP6DZY~1.PNG")) returned 0x5c8ec0 [0035.122] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dad7c40, ftCreationTime.dwHighDateTime=0x1d4cbcc, ftLastAccessTime.dwLowDateTime=0xfdf78a60, ftLastAccessTime.dwHighDateTime=0x1d4cee8, ftLastWriteTime.dwLowDateTime=0xfdf78a60, ftLastWriteTime.dwHighDateTime=0x1d4cee8, nFileSizeHigh=0x0, nFileSizeLow=0x129a2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="fp6DzYig6j9.png", cAlternateFileName="FP6DZY~1.PNG")) returned 0 [0035.122] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.123] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fp6DzYig6j9.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fp6dzyig6j9.png")) returned 1 [0035.124] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\fp6DzYig6j9.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fp6dzyig6j9.png")) returned 0xffffffff [0035.124] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a29950, ftCreationTime.dwHighDateTime=0x1d4ce18, ftLastAccessTime.dwLowDateTime=0xf2f14b40, ftLastAccessTime.dwHighDateTime=0x1d4cb57, ftLastWriteTime.dwLowDateTime=0xf2f14b40, ftLastWriteTime.dwHighDateTime=0x1d4cb57, nFileSizeHigh=0x0, nFileSizeLow=0xbd8b, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="FtJuB8_WULa.jpg", cAlternateFileName="FTJUB8~1.JPG")) returned 1 [0035.124] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FtJuB8_WULa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ftjub8_wula.jpg")) returned 0x20 [0035.125] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FtJuB8_WULa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ftjub8_wula.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.125] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FtJuB8_WULa.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ftjub8_wula.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.125] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.126] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.127] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.127] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.127] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.127] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.127] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.127] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.127] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.128] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.128] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.128] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.129] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.129] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.129] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.129] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.129] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.129] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.130] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.130] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.130] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.130] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.130] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0xd8b, lpOverlapped=0x0) returned 1 [0035.130] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0xd8b, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0xd8b, lpOverlapped=0x0) returned 1 [0035.130] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.130] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.130] CloseHandle (hObject=0xec) returned 1 [0035.130] CloseHandle (hObject=0xe8) returned 1 [0035.131] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FtJuB8_WULa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ftjub8_wula.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FtJuB8_WULa.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ftjub8_wula.jpg.crypt")) returned 0 [0035.131] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FtJuB8_WULa.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ftjub8_wula.jpg.crypt")) returned 0x20 [0035.131] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FtJuB8_WULa.jpg", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a29950, ftCreationTime.dwHighDateTime=0x1d4ce18, ftLastAccessTime.dwLowDateTime=0xf2f14b40, ftLastAccessTime.dwHighDateTime=0x1d4cb57, ftLastWriteTime.dwLowDateTime=0xf2f14b40, ftLastWriteTime.dwHighDateTime=0x1d4cb57, nFileSizeHigh=0x0, nFileSizeLow=0xbd8b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="FtJuB8_WULa.jpg", cAlternateFileName="FTJUB8~1.JPG")) returned 0x5c8ec0 [0035.131] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a29950, ftCreationTime.dwHighDateTime=0x1d4ce18, ftLastAccessTime.dwLowDateTime=0xf2f14b40, ftLastAccessTime.dwHighDateTime=0x1d4cb57, ftLastWriteTime.dwLowDateTime=0xf2f14b40, ftLastWriteTime.dwHighDateTime=0x1d4cb57, nFileSizeHigh=0x0, nFileSizeLow=0xbd8b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="FtJuB8_WULa.jpg", cAlternateFileName="FTJUB8~1.JPG")) returned 0 [0035.131] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.131] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FtJuB8_WULa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ftjub8_wula.jpg")) returned 1 [0035.132] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FtJuB8_WULa.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ftjub8_wula.jpg")) returned 0xffffffff [0035.133] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d942c70, ftCreationTime.dwHighDateTime=0x1d4d29f, ftLastAccessTime.dwLowDateTime=0x45fecd10, ftLastAccessTime.dwHighDateTime=0x1d4d2e4, ftLastWriteTime.dwLowDateTime=0x45fecd10, ftLastWriteTime.dwHighDateTime=0x1d4d2e4, nFileSizeHigh=0x0, nFileSizeLow=0x93a3, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="I f1ZnX-HR.bmp", cAlternateFileName="IF1ZNX~1.BMP")) returned 1 [0035.133] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x550da400, ftCreationTime.dwHighDateTime=0x1d4d534, ftLastAccessTime.dwLowDateTime=0xcbc021f0, ftLastAccessTime.dwHighDateTime=0x1d4c8d6, ftLastWriteTime.dwLowDateTime=0xcbc021f0, ftLastWriteTime.dwHighDateTime=0x1d4c8d6, nFileSizeHigh=0x0, nFileSizeLow=0x6041, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="McWc.jpg", cAlternateFileName="")) returned 1 [0035.133] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\McWc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcwc.jpg")) returned 0x20 [0035.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\McWc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcwc.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\McWc.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcwc.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.133] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.134] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.135] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.135] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.135] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.135] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.135] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.136] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.136] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.136] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.136] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.136] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.136] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x41, lpOverlapped=0x0) returned 1 [0035.136] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x41, lpOverlapped=0x0) returned 1 [0035.136] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.137] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.137] CloseHandle (hObject=0xe8) returned 1 [0035.137] CloseHandle (hObject=0xec) returned 1 [0035.137] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\McWc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcwc.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\McWc.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcwc.jpg.crypt")) returned 0 [0035.137] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\McWc.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcwc.jpg.crypt")) returned 0x20 [0035.137] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\McWc.jpg", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x550da400, ftCreationTime.dwHighDateTime=0x1d4d534, ftLastAccessTime.dwLowDateTime=0xcbc021f0, ftLastAccessTime.dwHighDateTime=0x1d4c8d6, ftLastWriteTime.dwLowDateTime=0xcbc021f0, ftLastWriteTime.dwHighDateTime=0x1d4c8d6, nFileSizeHigh=0x0, nFileSizeLow=0x6041, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="McWc.jpg", cAlternateFileName="")) returned 0x5c8ec0 [0035.137] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x550da400, ftCreationTime.dwHighDateTime=0x1d4d534, ftLastAccessTime.dwLowDateTime=0xcbc021f0, ftLastAccessTime.dwHighDateTime=0x1d4c8d6, ftLastWriteTime.dwLowDateTime=0xcbc021f0, ftLastWriteTime.dwHighDateTime=0x1d4c8d6, nFileSizeHigh=0x0, nFileSizeLow=0x6041, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="McWc.jpg", cAlternateFileName="")) returned 0 [0035.137] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.137] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\McWc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcwc.jpg")) returned 1 [0035.139] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\McWc.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\mcwc.jpg")) returned 0xffffffff [0035.140] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4989e10, ftCreationTime.dwHighDateTime=0x1d4d38c, ftLastAccessTime.dwLowDateTime=0xb7723ee0, ftLastAccessTime.dwHighDateTime=0x1d4d4d4, ftLastWriteTime.dwLowDateTime=0xb7723ee0, ftLastWriteTime.dwHighDateTime=0x1d4d4d4, nFileSizeHigh=0x0, nFileSizeLow=0x1355, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Qc87LZYu5MnLTcCw5Q.gif", cAlternateFileName="QC87LZ~1.GIF")) returned 1 [0035.140] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239ec4c0, ftCreationTime.dwHighDateTime=0x1d4d54e, ftLastAccessTime.dwLowDateTime=0x31552630, ftLastAccessTime.dwHighDateTime=0x1d4d180, ftLastWriteTime.dwLowDateTime=0x31552630, ftLastWriteTime.dwHighDateTime=0x1d4d180, nFileSizeHigh=0x0, nFileSizeLow=0x161d7, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="rfTi4jYQDV0uM8w0K.jpg", cAlternateFileName="RFTI4J~1.JPG")) returned 1 [0035.140] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\rfTi4jYQDV0uM8w0K.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rfti4jyqdv0um8w0k.jpg")) returned 0x20 [0035.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\rfTi4jYQDV0uM8w0K.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rfti4jyqdv0um8w0k.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\rfTi4jYQDV0uM8w0K.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rfti4jyqdv0um8w0k.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.156] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.156] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.157] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.157] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.158] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.158] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.158] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.158] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.158] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.158] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.158] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.159] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.159] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.159] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.159] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.159] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.159] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.159] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.160] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.160] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.160] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.160] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.160] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.160] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.160] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.161] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.161] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.161] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.161] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.161] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.161] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.162] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.162] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.162] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.162] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.162] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.162] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.162] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.163] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.163] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.163] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.163] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.163] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.163] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.163] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1d7, lpOverlapped=0x0) returned 1 [0035.163] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1d7, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1d7, lpOverlapped=0x0) returned 1 [0035.164] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.164] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.164] CloseHandle (hObject=0xec) returned 1 [0035.164] CloseHandle (hObject=0xe8) returned 1 [0035.164] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\rfTi4jYQDV0uM8w0K.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rfti4jyqdv0um8w0k.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\rfTi4jYQDV0uM8w0K.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rfti4jyqdv0um8w0k.jpg.crypt")) returned 0 [0035.164] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\rfTi4jYQDV0uM8w0K.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rfti4jyqdv0um8w0k.jpg.crypt")) returned 0x20 [0035.164] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\rfTi4jYQDV0uM8w0K.jpg", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239ec4c0, ftCreationTime.dwHighDateTime=0x1d4d54e, ftLastAccessTime.dwLowDateTime=0x31552630, ftLastAccessTime.dwHighDateTime=0x1d4d180, ftLastWriteTime.dwLowDateTime=0x31552630, ftLastWriteTime.dwHighDateTime=0x1d4d180, nFileSizeHigh=0x0, nFileSizeLow=0x161d7, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="rfTi4jYQDV0uM8w0K.jpg", cAlternateFileName="RFTI4J~1.JPG")) returned 0x5c8ec0 [0035.164] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239ec4c0, ftCreationTime.dwHighDateTime=0x1d4d54e, ftLastAccessTime.dwLowDateTime=0x31552630, ftLastAccessTime.dwHighDateTime=0x1d4d180, ftLastWriteTime.dwLowDateTime=0x31552630, ftLastWriteTime.dwHighDateTime=0x1d4d180, nFileSizeHigh=0x0, nFileSizeLow=0x161d7, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="rfTi4jYQDV0uM8w0K.jpg", cAlternateFileName="RFTI4J~1.JPG")) returned 0 [0035.164] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.164] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\rfTi4jYQDV0uM8w0K.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rfti4jyqdv0um8w0k.jpg")) returned 1 [0035.166] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\rfTi4jYQDV0uM8w0K.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rfti4jyqdv0um8w0k.jpg")) returned 0xffffffff [0035.166] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e5ce7d0, ftCreationTime.dwHighDateTime=0x1d4c95c, ftLastAccessTime.dwLowDateTime=0x3783c070, ftLastAccessTime.dwHighDateTime=0x1d4cf7d, ftLastWriteTime.dwLowDateTime=0x3783c070, ftLastWriteTime.dwHighDateTime=0x1d4cf7d, nFileSizeHigh=0x0, nFileSizeLow=0x17dd4, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="tvoXA_h.png", cAlternateFileName="")) returned 1 [0035.166] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tvoXA_h.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tvoxa_h.png")) returned 0x20 [0035.166] VirtualAlloc (lpAddress=0x31e8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31e8000 [0035.166] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tvoXA_h.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tvoxa_h.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.167] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tvoXA_h.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tvoxa_h.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.167] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.168] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.169] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.169] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.169] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.169] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.169] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.169] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.169] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.170] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.170] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.170] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.170] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.170] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.170] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.170] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.171] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.171] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.171] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.171] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.172] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.172] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.172] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.172] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.172] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.172] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.172] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.173] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.173] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.173] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.173] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.173] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.173] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.173] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.174] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.174] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.174] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.174] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.174] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.174] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.174] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.175] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.175] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.175] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.175] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.175] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.175] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0xdd4, lpOverlapped=0x0) returned 1 [0035.175] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0xdd4, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0xdd4, lpOverlapped=0x0) returned 1 [0035.176] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.176] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.176] CloseHandle (hObject=0xe8) returned 1 [0035.176] CloseHandle (hObject=0xec) returned 1 [0035.176] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tvoXA_h.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tvoxa_h.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tvoXA_h.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tvoxa_h.png.crypt")) returned 0 [0035.176] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tvoXA_h.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tvoxa_h.png.crypt")) returned 0x20 [0035.176] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tvoXA_h.png", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e5ce7d0, ftCreationTime.dwHighDateTime=0x1d4c95c, ftLastAccessTime.dwLowDateTime=0x3783c070, ftLastAccessTime.dwHighDateTime=0x1d4cf7d, ftLastWriteTime.dwLowDateTime=0x3783c070, ftLastWriteTime.dwHighDateTime=0x1d4cf7d, nFileSizeHigh=0x0, nFileSizeLow=0x17dd4, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="tvoXA_h.png", cAlternateFileName="")) returned 0x5c8ec0 [0035.176] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e5ce7d0, ftCreationTime.dwHighDateTime=0x1d4c95c, ftLastAccessTime.dwLowDateTime=0x3783c070, ftLastAccessTime.dwHighDateTime=0x1d4cf7d, ftLastWriteTime.dwLowDateTime=0x3783c070, ftLastWriteTime.dwHighDateTime=0x1d4cf7d, nFileSizeHigh=0x0, nFileSizeLow=0x17dd4, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="tvoXA_h.png", cAlternateFileName="")) returned 0 [0035.176] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.176] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tvoXA_h.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tvoxa_h.png")) returned 1 [0035.178] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\tvoXA_h.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tvoxa_h.png")) returned 0xffffffff [0035.178] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fdce020, ftCreationTime.dwHighDateTime=0x1d4d365, ftLastAccessTime.dwLowDateTime=0x784ee770, ftLastAccessTime.dwHighDateTime=0x1d4c58b, ftLastWriteTime.dwLowDateTime=0x784ee770, ftLastWriteTime.dwHighDateTime=0x1d4c58b, nFileSizeHigh=0x0, nFileSizeLow=0x7b64, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="VHqzI_mN.bmp", cAlternateFileName="")) returned 1 [0035.178] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad73e0, ftCreationTime.dwHighDateTime=0x1d4c591, ftLastAccessTime.dwLowDateTime=0xd72053e0, ftLastAccessTime.dwHighDateTime=0x1d4cb96, ftLastWriteTime.dwLowDateTime=0xd72053e0, ftLastWriteTime.dwHighDateTime=0x1d4cb96, nFileSizeHigh=0x0, nFileSizeLow=0x168a8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="WRWYt_i7n2.png", cAlternateFileName="WRWYT_~1.PNG")) returned 1 [0035.178] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WRWYt_i7n2.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wrwyt_i7n2.png")) returned 0x20 [0035.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WRWYt_i7n2.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wrwyt_i7n2.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.178] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WRWYt_i7n2.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wrwyt_i7n2.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.179] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.180] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.181] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.181] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.181] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.181] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.181] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.181] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.181] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.182] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.182] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.182] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.182] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.182] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.182] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.182] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.183] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.183] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.183] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.183] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.183] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.184] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.184] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.184] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.184] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.184] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.184] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.184] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.185] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.185] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.185] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.185] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.185] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.185] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.185] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.186] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.186] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.186] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.186] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.186] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.186] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.187] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.187] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.187] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.187] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x8a8, lpOverlapped=0x0) returned 1 [0035.187] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x8a8, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x8a8, lpOverlapped=0x0) returned 1 [0035.188] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.188] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.188] CloseHandle (hObject=0xec) returned 1 [0035.188] CloseHandle (hObject=0xe8) returned 1 [0035.188] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WRWYt_i7n2.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wrwyt_i7n2.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WRWYt_i7n2.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wrwyt_i7n2.png.crypt")) returned 0 [0035.188] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WRWYt_i7n2.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wrwyt_i7n2.png.crypt")) returned 0x20 [0035.188] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WRWYt_i7n2.png", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad73e0, ftCreationTime.dwHighDateTime=0x1d4c591, ftLastAccessTime.dwLowDateTime=0xd72053e0, ftLastAccessTime.dwHighDateTime=0x1d4cb96, ftLastWriteTime.dwLowDateTime=0xd72053e0, ftLastWriteTime.dwHighDateTime=0x1d4cb96, nFileSizeHigh=0x0, nFileSizeLow=0x168a8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="WRWYt_i7n2.png", cAlternateFileName="WRWYT_~1.PNG")) returned 0x5c8ec0 [0035.188] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad73e0, ftCreationTime.dwHighDateTime=0x1d4c591, ftLastAccessTime.dwLowDateTime=0xd72053e0, ftLastAccessTime.dwHighDateTime=0x1d4cb96, ftLastWriteTime.dwLowDateTime=0xd72053e0, ftLastWriteTime.dwHighDateTime=0x1d4cb96, nFileSizeHigh=0x0, nFileSizeLow=0x168a8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="WRWYt_i7n2.png", cAlternateFileName="WRWYT_~1.PNG")) returned 0 [0035.188] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.188] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WRWYt_i7n2.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wrwyt_i7n2.png")) returned 1 [0035.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\WRWYt_i7n2.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\wrwyt_i7n2.png")) returned 0xffffffff [0035.190] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf57374a0, ftCreationTime.dwHighDateTime=0x1d4d22e, ftLastAccessTime.dwLowDateTime=0x3c5d1940, ftLastAccessTime.dwHighDateTime=0x1d4cf4e, ftLastWriteTime.dwLowDateTime=0x3c5d1940, ftLastWriteTime.dwHighDateTime=0x1d4cf4e, nFileSizeHigh=0x0, nFileSizeLow=0x18212, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="XsD0o5hKl2npcDCg2IIF.jpg", cAlternateFileName="XSD0O5~1.JPG")) returned 1 [0035.190] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XsD0o5hKl2npcDCg2IIF.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xsd0o5hkl2npcdcg2iif.jpg")) returned 0x20 [0035.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XsD0o5hKl2npcDCg2IIF.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xsd0o5hkl2npcdcg2iif.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XsD0o5hKl2npcDCg2IIF.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xsd0o5hkl2npcdcg2iif.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.191] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.191] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.192] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.193] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.193] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.193] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.193] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.193] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.193] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.193] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.194] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.194] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.194] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.194] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.194] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.194] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.194] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.195] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.195] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.195] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.195] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.195] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.195] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.196] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.196] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.196] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.196] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.196] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.196] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.196] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.197] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.197] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.197] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.197] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.197] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.197] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.198] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.198] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.198] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.198] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.198] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.198] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.198] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.199] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.199] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.199] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.199] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.199] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.199] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x212, lpOverlapped=0x0) returned 1 [0035.200] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x212, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x212, lpOverlapped=0x0) returned 1 [0035.200] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.200] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.200] CloseHandle (hObject=0xe8) returned 1 [0035.200] CloseHandle (hObject=0xec) returned 1 [0035.200] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XsD0o5hKl2npcDCg2IIF.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xsd0o5hkl2npcdcg2iif.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XsD0o5hKl2npcDCg2IIF.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xsd0o5hkl2npcdcg2iif.jpg.crypt")) returned 0 [0035.200] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XsD0o5hKl2npcDCg2IIF.jpg.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xsd0o5hkl2npcdcg2iif.jpg.crypt")) returned 0x20 [0035.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XsD0o5hKl2npcDCg2IIF.jpg", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf57374a0, ftCreationTime.dwHighDateTime=0x1d4d22e, ftLastAccessTime.dwLowDateTime=0x3c5d1940, ftLastAccessTime.dwHighDateTime=0x1d4cf4e, ftLastWriteTime.dwLowDateTime=0x3c5d1940, ftLastWriteTime.dwHighDateTime=0x1d4cf4e, nFileSizeHigh=0x0, nFileSizeLow=0x18212, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="XsD0o5hKl2npcDCg2IIF.jpg", cAlternateFileName="XSD0O5~1.JPG")) returned 0x5c8ec0 [0035.200] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf57374a0, ftCreationTime.dwHighDateTime=0x1d4d22e, ftLastAccessTime.dwLowDateTime=0x3c5d1940, ftLastAccessTime.dwHighDateTime=0x1d4cf4e, ftLastWriteTime.dwLowDateTime=0x3c5d1940, ftLastWriteTime.dwHighDateTime=0x1d4cf4e, nFileSizeHigh=0x0, nFileSizeLow=0x18212, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="XsD0o5hKl2npcDCg2IIF.jpg", cAlternateFileName="XSD0O5~1.JPG")) returned 0 [0035.200] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.200] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XsD0o5hKl2npcDCg2IIF.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xsd0o5hkl2npcdcg2iif.jpg")) returned 1 [0035.202] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XsD0o5hKl2npcDCg2IIF.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xsd0o5hkl2npcdcg2iif.jpg")) returned 0xffffffff [0035.202] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf458cd70, ftCreationTime.dwHighDateTime=0x1d4ce6b, ftLastAccessTime.dwLowDateTime=0x209efe60, ftLastAccessTime.dwHighDateTime=0x1d4c97e, ftLastWriteTime.dwLowDateTime=0x209efe60, ftLastWriteTime.dwHighDateTime=0x1d4c97e, nFileSizeHigh=0x0, nFileSizeLow=0x18714, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="XY9FEIK2DpgtI.png", cAlternateFileName="XY9FEI~1.PNG")) returned 1 [0035.202] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XY9FEIK2DpgtI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xy9feik2dpgti.png")) returned 0x20 [0035.202] VirtualAlloc (lpAddress=0x31ec000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x31ec000 [0035.203] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XY9FEIK2DpgtI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xy9feik2dpgti.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.203] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XY9FEIK2DpgtI.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xy9feik2dpgti.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.203] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.204] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.205] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.205] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.205] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.205] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.205] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.206] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.206] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.206] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.206] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.206] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.206] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.207] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.207] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.207] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.207] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.207] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.207] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.207] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.208] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.208] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.208] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.208] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.208] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.208] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.208] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.209] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.209] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.209] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.209] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.209] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.209] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.210] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.210] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.210] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.210] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.210] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.210] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.210] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.211] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.211] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.211] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.211] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.211] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.211] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.211] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.212] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1000, lpOverlapped=0x0) returned 1 [0035.212] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x714, lpOverlapped=0x0) returned 1 [0035.212] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x714, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x714, lpOverlapped=0x0) returned 1 [0035.212] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.212] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.212] CloseHandle (hObject=0xec) returned 1 [0035.212] CloseHandle (hObject=0xe8) returned 1 [0035.212] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XY9FEIK2DpgtI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xy9feik2dpgti.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XY9FEIK2DpgtI.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xy9feik2dpgti.png.crypt")) returned 0 [0035.213] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XY9FEIK2DpgtI.png.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xy9feik2dpgti.png.crypt")) returned 0x20 [0035.213] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XY9FEIK2DpgtI.png", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf458cd70, ftCreationTime.dwHighDateTime=0x1d4ce6b, ftLastAccessTime.dwLowDateTime=0x209efe60, ftLastAccessTime.dwHighDateTime=0x1d4c97e, ftLastWriteTime.dwLowDateTime=0x209efe60, ftLastWriteTime.dwHighDateTime=0x1d4c97e, nFileSizeHigh=0x0, nFileSizeLow=0x18714, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="XY9FEIK2DpgtI.png", cAlternateFileName="XY9FEI~1.PNG")) returned 0x5c8ec0 [0035.213] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf458cd70, ftCreationTime.dwHighDateTime=0x1d4ce6b, ftLastAccessTime.dwLowDateTime=0x209efe60, ftLastAccessTime.dwHighDateTime=0x1d4c97e, ftLastWriteTime.dwLowDateTime=0x209efe60, ftLastWriteTime.dwHighDateTime=0x1d4c97e, nFileSizeHigh=0x0, nFileSizeLow=0x18714, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="XY9FEIK2DpgtI.png", cAlternateFileName="XY9FEI~1.PNG")) returned 0 [0035.213] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.213] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XY9FEIK2DpgtI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xy9feik2dpgti.png")) returned 1 [0035.215] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\XY9FEIK2DpgtI.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xy9feik2dpgti.png")) returned 0xffffffff [0035.215] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf458cd70, ftCreationTime.dwHighDateTime=0x1d4ce6b, ftLastAccessTime.dwLowDateTime=0x209efe60, ftLastAccessTime.dwHighDateTime=0x1d4c97e, ftLastWriteTime.dwLowDateTime=0x209efe60, ftLastWriteTime.dwHighDateTime=0x1d4c97e, nFileSizeHigh=0x0, nFileSizeLow=0x18714, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="XY9FEIK2DpgtI.png", cAlternateFileName="XY9FEI~1.PNG")) returned 0 [0035.215] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0035.215] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x4949676e, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0035.215] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf458cd70, ftCreationTime.dwHighDateTime=0x1d4ce6b, ftLastAccessTime.dwLowDateTime=0x209efe60, ftLastAccessTime.dwHighDateTime=0x1d4c97e, ftLastWriteTime.dwLowDateTime=0x209efe60, ftLastWriteTime.dwHighDateTime=0x1d4c97e, nFileSizeHigh=0x0, nFileSizeLow=0x18714, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="XY9FEIK2DpgtI.png", cAlternateFileName="\xb0\x4c\x5c")) returned 0xffffffff [0035.215] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x4949676e, cFileName="Recent", cAlternateFileName="")) returned 1 [0035.215] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf458cd70, ftCreationTime.dwHighDateTime=0x1d4ce6b, ftLastAccessTime.dwLowDateTime=0x209efe60, ftLastAccessTime.dwHighDateTime=0x1d4c97e, ftLastWriteTime.dwLowDateTime=0x209efe60, ftLastWriteTime.dwHighDateTime=0x1d4c97e, nFileSizeHigh=0x0, nFileSizeLow=0x18714, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="XY9FEIK2DpgtI.png", cAlternateFileName="\xb0\x4c\x5c")) returned 0xffffffff [0035.215] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x4949676e, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0035.215] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0035.215] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.216] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0035.216] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini")) returned 0x26 [0035.216] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.216] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.216] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x11a, lpOverlapped=0x0) returned 1 [0035.217] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x11a, lpOverlapped=0x0) returned 1 [0035.219] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.219] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.219] CloseHandle (hObject=0xe8) returned 1 [0035.219] CloseHandle (hObject=0xec) returned 1 [0035.219] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini.crypt")) returned 0 [0035.219] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini.crypt")) returned 0x20 [0035.219] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0035.219] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0035.220] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.220] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini")) returned 1 [0035.220] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\desktop.ini")) returned 0xffffffff [0035.220] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0035.221] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0035.221] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x4949676e, cFileName="Searches", cAlternateFileName="")) returned 1 [0035.221] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0035.221] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0035.221] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0035.221] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini")) returned 0x26 [0035.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.221] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x20c, lpOverlapped=0x0) returned 1 [0035.222] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x20c, lpOverlapped=0x0) returned 1 [0035.223] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.223] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.223] CloseHandle (hObject=0xec) returned 1 [0035.223] CloseHandle (hObject=0xe8) returned 1 [0035.223] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini.crypt")) returned 0 [0035.224] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini.crypt")) returned 0x20 [0035.224] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0035.224] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0035.224] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.224] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini")) returned 1 [0035.225] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\desktop.ini")) returned 0xffffffff [0035.225] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0035.225] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0035.225] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0035.225] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0035.225] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="SendTo", cAlternateFileName="")) returned 1 [0035.225] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Indexed Locations.search-ms", cAlternateFileName="\xb0\x4c\x5c")) returned 0xffffffff [0035.225] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0035.225] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Indexed Locations.search-ms", cAlternateFileName="\xb0\x4c\x5c")) returned 0xffffffff [0035.225] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0035.225] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Indexed Locations.search-ms", cAlternateFileName="\xb0\x4c\x5c")) returned 0xffffffff [0035.225] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x950e7e20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x950e7e20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Videos", cAlternateFileName="")) returned 1 [0035.225] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x950e7e20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x950e7e20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0035.225] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x950e7e20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x950e7e20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0035.225] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8f8f3f0, ftCreationTime.dwHighDateTime=0x1d4d302, ftLastAccessTime.dwLowDateTime=0xaa05c350, ftLastAccessTime.dwHighDateTime=0x1d4c6bd, ftLastWriteTime.dwLowDateTime=0xaa05c350, ftLastWriteTime.dwHighDateTime=0x1d4c6bd, nFileSizeHigh=0x0, nFileSizeLow=0x1827, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="5okAbAjGF7dXMESSH7p1.swf", cAlternateFileName="5OKABA~1.SWF")) returned 1 [0035.225] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbed70, ftCreationTime.dwHighDateTime=0x1d4d068, ftLastAccessTime.dwLowDateTime=0xd7d68f10, ftLastAccessTime.dwHighDateTime=0x1d4c6b5, ftLastWriteTime.dwLowDateTime=0xd7d68f10, ftLastWriteTime.dwHighDateTime=0x1d4c6b5, nFileSizeHigh=0x0, nFileSizeLow=0x83c4, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="AwhcK6mbhp1Hc cwf4c.avi", cAlternateFileName="AWHCK6~1.AVI")) returned 1 [0035.226] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc00e220, ftCreationTime.dwHighDateTime=0x1d4c9c6, ftLastAccessTime.dwLowDateTime=0x18f291b0, ftLastAccessTime.dwHighDateTime=0x1d4d41c, ftLastWriteTime.dwLowDateTime=0x18f291b0, ftLastWriteTime.dwHighDateTime=0x1d4d41c, nFileSizeHigh=0x0, nFileSizeLow=0x65a3, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="BTGLO1I4z9S60.mkv", cAlternateFileName="BTGLO1~1.MKV")) returned 1 [0035.226] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0035.226] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini")) returned 0x26 [0035.226] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x32f0000 [0035.226] VirtualAlloc (lpAddress=0x32f0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x32f0000 [0035.226] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0035.226] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0035.227] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1f8, lpOverlapped=0x0) returned 1 [0035.227] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1f8, lpOverlapped=0x0) returned 1 [0035.229] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.229] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0035.230] CloseHandle (hObject=0xe8) returned 1 [0035.230] CloseHandle (hObject=0xec) returned 1 [0035.230] MoveFileA (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini.crypt")) returned 0 [0035.230] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini.crypt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini.crypt")) returned 0x20 [0035.230] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0035.230] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0035.230] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.230] DeleteFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini")) returned 1 [0035.231] GetFileAttributesA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\desktop.ini")) returned 0xffffffff [0035.231] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b55390, ftCreationTime.dwHighDateTime=0x1d4d3e2, ftLastAccessTime.dwLowDateTime=0x23c873f0, ftLastAccessTime.dwHighDateTime=0x1d4d108, ftLastWriteTime.dwLowDateTime=0x23c873f0, ftLastWriteTime.dwHighDateTime=0x1d4d108, nFileSizeHigh=0x0, nFileSizeLow=0x98d2, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="hzTuwy- b.avi", cAlternateFileName="HZTUWY~1.AVI")) returned 1 [0035.231] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cacde30, ftCreationTime.dwHighDateTime=0x1d4c7bf, ftLastAccessTime.dwLowDateTime=0x22872360, ftLastAccessTime.dwHighDateTime=0x1d4c88e, ftLastWriteTime.dwLowDateTime=0x22872360, ftLastWriteTime.dwHighDateTime=0x1d4c88e, nFileSizeHigh=0x0, nFileSizeLow=0x1550d, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="k8qWPZoJVU.mp4", cAlternateFileName="K8QWPZ~1.MP4")) returned 1 [0035.231] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfb89d60, ftCreationTime.dwHighDateTime=0x1d4d513, ftLastAccessTime.dwLowDateTime=0xca573370, ftLastAccessTime.dwHighDateTime=0x1d4ca94, ftLastWriteTime.dwLowDateTime=0xca573370, ftLastWriteTime.dwHighDateTime=0x1d4ca94, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="NmYHleAHvhFUD", cAlternateFileName="NMYHLE~1")) returned 1 [0035.231] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NmYHleAHvhFUD\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfb89d60, ftCreationTime.dwHighDateTime=0x1d4d513, ftLastAccessTime.dwLowDateTime=0xca573370, ftLastAccessTime.dwHighDateTime=0x1d4ca94, ftLastWriteTime.dwLowDateTime=0xca573370, ftLastWriteTime.dwHighDateTime=0x1d4ca94, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x60, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0035.231] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfb89d60, ftCreationTime.dwHighDateTime=0x1d4d513, ftLastAccessTime.dwLowDateTime=0xca573370, ftLastAccessTime.dwHighDateTime=0x1d4ca94, ftLastWriteTime.dwLowDateTime=0xca573370, ftLastWriteTime.dwHighDateTime=0x1d4ca94, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x60, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.231] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8519bca0, ftCreationTime.dwHighDateTime=0x1d4d422, ftLastAccessTime.dwLowDateTime=0x8eb4a580, ftLastAccessTime.dwHighDateTime=0x1d4c758, ftLastWriteTime.dwLowDateTime=0x8eb4a580, ftLastWriteTime.dwHighDateTime=0x1d4c758, nFileSizeHigh=0x0, nFileSizeLow=0x1550d, dwReserved0=0x60, dwReserved1=0x0, cFileName="63lPZq3SNnHAORv23yF.flv", cAlternateFileName="63LPZQ~1.FLV")) returned 1 [0035.231] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe208ea10, ftCreationTime.dwHighDateTime=0x1d4cff1, ftLastAccessTime.dwLowDateTime=0x2e6c5670, ftLastAccessTime.dwHighDateTime=0x1d4c6b1, ftLastWriteTime.dwLowDateTime=0x2e6c5670, ftLastWriteTime.dwHighDateTime=0x1d4c6b1, nFileSizeHigh=0x0, nFileSizeLow=0x1c77, dwReserved0=0x60, dwReserved1=0x0, cFileName="6AMH.mkv", cAlternateFileName="")) returned 1 [0035.231] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5343870, ftCreationTime.dwHighDateTime=0x1d4c574, ftLastAccessTime.dwLowDateTime=0x54f04540, ftLastAccessTime.dwHighDateTime=0x1d4cba2, ftLastWriteTime.dwLowDateTime=0x54f04540, ftLastWriteTime.dwHighDateTime=0x1d4cba2, nFileSizeHigh=0x0, nFileSizeLow=0xf4c5, dwReserved0=0x60, dwReserved1=0x0, cFileName="B77Jv1PcIX8nKuV-.mkv", cAlternateFileName="B77JV1~1.MKV")) returned 1 [0035.231] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc33420, ftCreationTime.dwHighDateTime=0x1d4cb64, ftLastAccessTime.dwLowDateTime=0x6c0a4860, ftLastAccessTime.dwHighDateTime=0x1d4d373, ftLastWriteTime.dwLowDateTime=0x6c0a4860, ftLastWriteTime.dwHighDateTime=0x1d4d373, nFileSizeHigh=0x0, nFileSizeLow=0x13831, dwReserved0=0x60, dwReserved1=0x0, cFileName="ePlCEO.mp4", cAlternateFileName="")) returned 1 [0035.231] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b87e200, ftCreationTime.dwHighDateTime=0x1d4d3fb, ftLastAccessTime.dwLowDateTime=0x7ccada00, ftLastAccessTime.dwHighDateTime=0x1d4cf4c, ftLastWriteTime.dwLowDateTime=0x7ccada00, ftLastWriteTime.dwHighDateTime=0x1d4cf4c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x60, dwReserved1=0x0, cFileName="LuoppkTQnaUtW", cAlternateFileName="LUOPPK~1")) returned 1 [0035.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NmYHleAHvhFUD\\LuoppkTQnaUtW\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b87e200, ftCreationTime.dwHighDateTime=0x1d4d3fb, ftLastAccessTime.dwLowDateTime=0x7ccada00, ftLastAccessTime.dwHighDateTime=0x1d4cf4c, ftLastWriteTime.dwLowDateTime=0x7ccada00, ftLastWriteTime.dwHighDateTime=0x1d4cf4c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b87e200, ftCreationTime.dwHighDateTime=0x1d4d3fb, ftLastAccessTime.dwLowDateTime=0x7ccada00, ftLastAccessTime.dwHighDateTime=0x1d4cf4c, ftLastWriteTime.dwLowDateTime=0x7ccada00, ftLastWriteTime.dwHighDateTime=0x1d4cf4c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x292ac430, ftCreationTime.dwHighDateTime=0x1d4c657, ftLastAccessTime.dwLowDateTime=0x25593e80, ftLastAccessTime.dwHighDateTime=0x1d4cd15, ftLastWriteTime.dwLowDateTime=0x25593e80, ftLastWriteTime.dwHighDateTime=0x1d4cd15, nFileSizeHigh=0x0, nFileSizeLow=0x11d08, dwReserved0=0x0, dwReserved1=0x0, cFileName="0YtuiGGy9hlr4Bel.avi", cAlternateFileName="0YTUIG~1.AVI")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20a19800, ftCreationTime.dwHighDateTime=0x1d4d135, ftLastAccessTime.dwLowDateTime=0x8b0f35d0, ftLastAccessTime.dwHighDateTime=0x1d4c7a8, ftLastWriteTime.dwLowDateTime=0x8b0f35d0, ftLastWriteTime.dwHighDateTime=0x1d4c7a8, nFileSizeHigh=0x0, nFileSizeLow=0x8fb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="afw5eefl4k46YWSl0 I.mp4", cAlternateFileName="AFW5EE~1.MP4")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10722c50, ftCreationTime.dwHighDateTime=0x1d4d3bb, ftLastAccessTime.dwLowDateTime=0x3865fff0, ftLastAccessTime.dwHighDateTime=0x1d4d4a8, ftLastWriteTime.dwLowDateTime=0x3865fff0, ftLastWriteTime.dwHighDateTime=0x1d4d4a8, nFileSizeHigh=0x0, nFileSizeLow=0xfe69, dwReserved0=0x0, dwReserved1=0x0, cFileName="az4V-dErc0oSCJc_JEsu.avi", cAlternateFileName="AZ4V-D~1.AVI")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x488c4f10, ftCreationTime.dwHighDateTime=0x1d4ccec, ftLastAccessTime.dwLowDateTime=0x15125e80, ftLastAccessTime.dwHighDateTime=0x1d4d2a1, ftLastWriteTime.dwLowDateTime=0x15125e80, ftLastWriteTime.dwHighDateTime=0x1d4d2a1, nFileSizeHigh=0x0, nFileSizeLow=0x11178, dwReserved0=0x0, dwReserved1=0x0, cFileName="clzlnKg2DDD.mkv", cAlternateFileName="CLZLNK~1.MKV")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda4a8d30, ftCreationTime.dwHighDateTime=0x1d4d2a6, ftLastAccessTime.dwLowDateTime=0xd3f424c0, ftLastAccessTime.dwHighDateTime=0x1d4c6b5, ftLastWriteTime.dwLowDateTime=0xd3f424c0, ftLastWriteTime.dwHighDateTime=0x1d4c6b5, nFileSizeHigh=0x0, nFileSizeLow=0xdede, dwReserved0=0x0, dwReserved1=0x0, cFileName="PVcYf9.flv", cAlternateFileName="")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x358248e0, ftCreationTime.dwHighDateTime=0x1d4c8df, ftLastAccessTime.dwLowDateTime=0x9a8d2f40, ftLastAccessTime.dwHighDateTime=0x1d4c6f8, ftLastWriteTime.dwLowDateTime=0x9a8d2f40, ftLastWriteTime.dwHighDateTime=0x1d4c6f8, nFileSizeHigh=0x0, nFileSizeLow=0x1279f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ur1x3_10TLgwqBBy.flv", cAlternateFileName="UR1X3_~1.FLV")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x358248e0, ftCreationTime.dwHighDateTime=0x1d4c8df, ftLastAccessTime.dwLowDateTime=0x9a8d2f40, ftLastAccessTime.dwHighDateTime=0x1d4c6f8, ftLastWriteTime.dwLowDateTime=0x9a8d2f40, ftLastWriteTime.dwHighDateTime=0x1d4c6f8, nFileSizeHigh=0x0, nFileSizeLow=0x1279f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ur1x3_10TLgwqBBy.flv", cAlternateFileName="UR1X3_~1.FLV")) returned 0 [0035.232] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27a05ee0, ftCreationTime.dwHighDateTime=0x1d4d3e5, ftLastAccessTime.dwLowDateTime=0xfbc5d730, ftLastAccessTime.dwHighDateTime=0x1d4d594, ftLastWriteTime.dwLowDateTime=0xfbc5d730, ftLastWriteTime.dwHighDateTime=0x1d4d594, nFileSizeHigh=0x0, nFileSizeLow=0xb7c9, dwReserved0=0x42427177, dwReserved1=0x6c662e79, cFileName="R4zvrcR.swf", cAlternateFileName="")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e767df0, ftCreationTime.dwHighDateTime=0x1d4d5a4, ftLastAccessTime.dwLowDateTime=0x1114ca90, ftLastAccessTime.dwHighDateTime=0x1d4cefd, ftLastWriteTime.dwLowDateTime=0x1114ca90, ftLastWriteTime.dwHighDateTime=0x1d4cefd, nFileSizeHigh=0x0, nFileSizeLow=0x49c3, dwReserved0=0x42427177, dwReserved1=0x6c662e79, cFileName="RrY6.mkv", cAlternateFileName="")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bca9a10, ftCreationTime.dwHighDateTime=0x1d4c5fb, ftLastAccessTime.dwLowDateTime=0x886c3e40, ftLastAccessTime.dwHighDateTime=0x1d4ced8, ftLastWriteTime.dwLowDateTime=0x886c3e40, ftLastWriteTime.dwHighDateTime=0x1d4ced8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42427177, dwReserved1=0x6c662e79, cFileName="v4noN7O sKB", cAlternateFileName="V4NON7~1")) returned 1 [0035.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NmYHleAHvhFUD\\v4noN7O sKB\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bca9a10, ftCreationTime.dwHighDateTime=0x1d4c5fb, ftLastAccessTime.dwLowDateTime=0x886c3e40, ftLastAccessTime.dwHighDateTime=0x1d4ced8, ftLastWriteTime.dwLowDateTime=0x886c3e40, ftLastWriteTime.dwHighDateTime=0x1d4ced8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bca9a10, ftCreationTime.dwHighDateTime=0x1d4c5fb, ftLastAccessTime.dwLowDateTime=0x886c3e40, ftLastAccessTime.dwHighDateTime=0x1d4ced8, ftLastWriteTime.dwLowDateTime=0x886c3e40, ftLastWriteTime.dwHighDateTime=0x1d4ced8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8b5f4a0, ftCreationTime.dwHighDateTime=0x1d4d210, ftLastAccessTime.dwLowDateTime=0x4853b8f0, ftLastAccessTime.dwHighDateTime=0x1d4d0c8, ftLastWriteTime.dwLowDateTime=0x4853b8f0, ftLastWriteTime.dwHighDateTime=0x1d4d0c8, nFileSizeHigh=0x0, nFileSizeLow=0x11d95, dwReserved0=0x0, dwReserved1=0x0, cFileName="0hBeYEF7Ft4.mkv", cAlternateFileName="0HBEYE~1.MKV")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c6ebb0, ftCreationTime.dwHighDateTime=0x1d4cf98, ftLastAccessTime.dwLowDateTime=0x30197de0, ftLastAccessTime.dwHighDateTime=0x1d4d36d, ftLastWriteTime.dwLowDateTime=0x30197de0, ftLastWriteTime.dwHighDateTime=0x1d4d36d, nFileSizeHigh=0x0, nFileSizeLow=0xcb21, dwReserved0=0x0, dwReserved1=0x0, cFileName="A-tY9u0qwXoK.swf", cAlternateFileName="A-TY9U~1.SWF")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x951bae40, ftCreationTime.dwHighDateTime=0x1d4c85d, ftLastAccessTime.dwLowDateTime=0x81a3c550, ftLastAccessTime.dwHighDateTime=0x1d4d299, ftLastWriteTime.dwLowDateTime=0x81a3c550, ftLastWriteTime.dwHighDateTime=0x1d4d299, nFileSizeHigh=0x0, nFileSizeLow=0x17fe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EwTuPJmGFKvFjN3.mp4", cAlternateFileName="EWTUPJ~1.MP4")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5b0a30, ftCreationTime.dwHighDateTime=0x1d4c6b3, ftLastAccessTime.dwLowDateTime=0xf619bcc0, ftLastAccessTime.dwHighDateTime=0x1d4c667, ftLastWriteTime.dwLowDateTime=0xf619bcc0, ftLastWriteTime.dwHighDateTime=0x1d4c667, nFileSizeHigh=0x0, nFileSizeLow=0xb4d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqW0-oJ-hD7GVCfIZGQ.mkv", cAlternateFileName="JQW0-O~1.MKV")) returned 1 [0035.232] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd02cf0, ftCreationTime.dwHighDateTime=0x1d4d25e, ftLastAccessTime.dwLowDateTime=0xd39cfb00, ftLastAccessTime.dwHighDateTime=0x1d4ccbe, ftLastWriteTime.dwLowDateTime=0xd39cfb00, ftLastWriteTime.dwHighDateTime=0x1d4ccbe, nFileSizeHigh=0x0, nFileSizeLow=0x6cc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="qGllBRYcOUgkbMkyQC9n.flv", cAlternateFileName="QGLLBR~1.FLV")) returned 1 [0035.233] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2abb120, ftCreationTime.dwHighDateTime=0x1d4c972, ftLastAccessTime.dwLowDateTime=0xaa4a2740, ftLastAccessTime.dwHighDateTime=0x1d4ce7c, ftLastWriteTime.dwLowDateTime=0xaa4a2740, ftLastWriteTime.dwHighDateTime=0x1d4ce7c, nFileSizeHigh=0x0, nFileSizeLow=0x9781, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMyE-gB aFi11e3K.swf", cAlternateFileName="UMYE-G~1.SWF")) returned 1 [0035.233] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2abb120, ftCreationTime.dwHighDateTime=0x1d4c972, ftLastAccessTime.dwLowDateTime=0xaa4a2740, ftLastAccessTime.dwHighDateTime=0x1d4ce7c, ftLastWriteTime.dwLowDateTime=0xaa4a2740, ftLastWriteTime.dwHighDateTime=0x1d4ce7c, nFileSizeHigh=0x0, nFileSizeLow=0x9781, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMyE-gB aFi11e3K.swf", cAlternateFileName="UMYE-G~1.SWF")) returned 0 [0035.233] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.233] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc4cbe0, ftCreationTime.dwHighDateTime=0x1d4c65f, ftLastAccessTime.dwLowDateTime=0xec2b05d0, ftLastAccessTime.dwHighDateTime=0x1d4d2f5, ftLastWriteTime.dwLowDateTime=0xec2b05d0, ftLastWriteTime.dwHighDateTime=0x1d4d2f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33653131, dwReserved1=0x77732e4b, cFileName="vd8DgU1S", cAlternateFileName="")) returned 1 [0035.233] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NmYHleAHvhFUD\\vd8DgU1S\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc4cbe0, ftCreationTime.dwHighDateTime=0x1d4c65f, ftLastAccessTime.dwLowDateTime=0xec2b05d0, ftLastAccessTime.dwHighDateTime=0x1d4d2f5, ftLastWriteTime.dwLowDateTime=0xec2b05d0, ftLastWriteTime.dwHighDateTime=0x1d4d2f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.233] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc4cbe0, ftCreationTime.dwHighDateTime=0x1d4c65f, ftLastAccessTime.dwLowDateTime=0xec2b05d0, ftLastAccessTime.dwHighDateTime=0x1d4d2f5, ftLastWriteTime.dwLowDateTime=0xec2b05d0, ftLastWriteTime.dwHighDateTime=0x1d4d2f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.233] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f723710, ftCreationTime.dwHighDateTime=0x1d4c70d, ftLastAccessTime.dwLowDateTime=0xe2684b70, ftLastAccessTime.dwHighDateTime=0x1d4c71a, ftLastWriteTime.dwLowDateTime=0xe2684b70, ftLastWriteTime.dwHighDateTime=0x1d4c71a, nFileSizeHigh=0x0, nFileSizeLow=0xec08, dwReserved0=0x0, dwReserved1=0x0, cFileName="av6EJhj6daw.flv", cAlternateFileName="AV6EJH~1.FLV")) returned 1 [0035.233] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb11d7570, ftCreationTime.dwHighDateTime=0x1d4c5b4, ftLastAccessTime.dwLowDateTime=0x2611f2f0, ftLastAccessTime.dwHighDateTime=0x1d4cc1f, ftLastWriteTime.dwLowDateTime=0x2611f2f0, ftLastWriteTime.dwHighDateTime=0x1d4cc1f, nFileSizeHigh=0x0, nFileSizeLow=0xd7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="D0wCnD.swf", cAlternateFileName="")) returned 1 [0035.233] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43d9b670, ftCreationTime.dwHighDateTime=0x1d4cbce, ftLastAccessTime.dwLowDateTime=0x98c73160, ftLastAccessTime.dwHighDateTime=0x1d4d071, ftLastWriteTime.dwLowDateTime=0x98c73160, ftLastWriteTime.dwHighDateTime=0x1d4d071, nFileSizeHigh=0x0, nFileSizeLow=0x17e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="kGd4Dp.flv", cAlternateFileName="")) returned 1 [0035.233] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4174ae50, ftCreationTime.dwHighDateTime=0x1d4cb13, ftLastAccessTime.dwLowDateTime=0xcf29e270, ftLastAccessTime.dwHighDateTime=0x1d4d1ed, ftLastWriteTime.dwLowDateTime=0xcf29e270, ftLastWriteTime.dwHighDateTime=0x1d4d1ed, nFileSizeHigh=0x0, nFileSizeLow=0xbc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ne QWZ6OS1v.mp4", cAlternateFileName="NEQWZ6~1.MP4")) returned 1 [0035.233] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30597300, ftCreationTime.dwHighDateTime=0x1d4c549, ftLastAccessTime.dwLowDateTime=0xb80fc790, ftLastAccessTime.dwHighDateTime=0x1d4c814, ftLastWriteTime.dwLowDateTime=0xb80fc790, ftLastWriteTime.dwHighDateTime=0x1d4c814, nFileSizeHigh=0x0, nFileSizeLow=0xee0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVs8isf1eAN_oRcfI.mkv", cAlternateFileName="YVS8IS~1.MKV")) returned 1 [0035.233] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30597300, ftCreationTime.dwHighDateTime=0x1d4c549, ftLastAccessTime.dwLowDateTime=0xb80fc790, ftLastAccessTime.dwHighDateTime=0x1d4c814, ftLastWriteTime.dwLowDateTime=0xb80fc790, ftLastWriteTime.dwHighDateTime=0x1d4c814, nFileSizeHigh=0x0, nFileSizeLow=0xee0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVs8isf1eAN_oRcfI.mkv", cAlternateFileName="YVS8IS~1.MKV")) returned 0 [0035.233] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.233] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d54e100, ftCreationTime.dwHighDateTime=0x1d4c777, ftLastAccessTime.dwLowDateTime=0xfd292a00, ftLastAccessTime.dwHighDateTime=0x1d4d0ad, ftLastWriteTime.dwLowDateTime=0xfd292a00, ftLastWriteTime.dwHighDateTime=0x1d4d0ad, nFileSizeHigh=0x0, nFileSizeLow=0xa378, dwReserved0=0x63526f5f, dwReserved1=0x6d2e4966, cFileName="X6AykOL2FK2Lb5zKk.swf", cAlternateFileName="X6AYKO~1.SWF")) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d54e100, ftCreationTime.dwHighDateTime=0x1d4c777, ftLastAccessTime.dwLowDateTime=0xfd292a00, ftLastAccessTime.dwHighDateTime=0x1d4d0ad, ftLastWriteTime.dwLowDateTime=0xfd292a00, ftLastWriteTime.dwHighDateTime=0x1d4d0ad, nFileSizeHigh=0x0, nFileSizeLow=0xa378, dwReserved0=0x63526f5f, dwReserved1=0x6d2e4966, cFileName="X6AykOL2FK2Lb5zKk.swf", cAlternateFileName="X6AYKO~1.SWF")) returned 0 [0035.234] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2958abd0, ftCreationTime.dwHighDateTime=0x1d4c674, ftLastAccessTime.dwLowDateTime=0x40536070, ftLastAccessTime.dwHighDateTime=0x1d4cfa0, ftLastWriteTime.dwLowDateTime=0x40536070, ftLastWriteTime.dwHighDateTime=0x1d4cfa0, nFileSizeHigh=0x0, nFileSizeLow=0x16c0b, dwReserved0=0x7a35624c, dwReserved1=0x732e6b4b, cFileName="NvfRbKM-Q.flv", cAlternateFileName="NVFRBK~1.FLV")) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d994790, ftCreationTime.dwHighDateTime=0x1d4d18a, ftLastAccessTime.dwLowDateTime=0xb6c12d40, ftLastAccessTime.dwHighDateTime=0x1d4cd53, ftLastWriteTime.dwLowDateTime=0xb6c12d40, ftLastWriteTime.dwHighDateTime=0x1d4cd53, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a35624c, dwReserved1=0x732e6b4b, cFileName="O4Yqd", cAlternateFileName="")) returned 1 [0035.234] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\O4Yqd\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d994790, ftCreationTime.dwHighDateTime=0x1d4d18a, ftLastAccessTime.dwLowDateTime=0xb6c12d40, ftLastAccessTime.dwHighDateTime=0x1d4cd53, ftLastWriteTime.dwLowDateTime=0xb6c12d40, ftLastWriteTime.dwHighDateTime=0x1d4cd53, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63526f5f, dwReserved1=0x6d2e4966, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0035.234] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d994790, ftCreationTime.dwHighDateTime=0x1d4d18a, ftLastAccessTime.dwLowDateTime=0xb6c12d40, ftLastAccessTime.dwHighDateTime=0x1d4cd53, ftLastWriteTime.dwLowDateTime=0xb6c12d40, ftLastWriteTime.dwHighDateTime=0x1d4cd53, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x63526f5f, dwReserved1=0x6d2e4966, cFileName="..", cAlternateFileName="")) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e92b470, ftCreationTime.dwHighDateTime=0x1d4cea5, ftLastAccessTime.dwLowDateTime=0xfd61fd60, ftLastAccessTime.dwHighDateTime=0x1d4d0e6, ftLastWriteTime.dwLowDateTime=0xfd61fd60, ftLastWriteTime.dwHighDateTime=0x1d4d0e6, nFileSizeHigh=0x0, nFileSizeLow=0x18d26, dwReserved0=0x63526f5f, dwReserved1=0x6d2e4966, cFileName="t6Ybl35E-1WGC.mkv", cAlternateFileName="T6YBL3~1.MKV")) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e92b470, ftCreationTime.dwHighDateTime=0x1d4cea5, ftLastAccessTime.dwLowDateTime=0xfd61fd60, ftLastAccessTime.dwHighDateTime=0x1d4d0e6, ftLastWriteTime.dwLowDateTime=0xfd61fd60, ftLastWriteTime.dwHighDateTime=0x1d4d0e6, nFileSizeHigh=0x0, nFileSizeLow=0x18d26, dwReserved0=0x63526f5f, dwReserved1=0x6d2e4966, cFileName="t6Ybl35E-1WGC.mkv", cAlternateFileName="T6YBL3~1.MKV")) returned 0 [0035.234] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14deacb0, ftCreationTime.dwHighDateTime=0x1d4cdb1, ftLastAccessTime.dwLowDateTime=0x60e246a0, ftLastAccessTime.dwHighDateTime=0x1d4d075, ftLastWriteTime.dwLowDateTime=0x60e246a0, ftLastWriteTime.dwHighDateTime=0x1d4d075, nFileSizeHigh=0x0, nFileSizeLow=0x1e28, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="Pj1QWg6ByW-.swf", cAlternateFileName="PJ1QWG~1.SWF")) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce26c6a0, ftCreationTime.dwHighDateTime=0x1d4c6f2, ftLastAccessTime.dwLowDateTime=0x5d1e0790, ftLastAccessTime.dwHighDateTime=0x1d4c641, ftLastWriteTime.dwLowDateTime=0x5d1e0790, ftLastWriteTime.dwHighDateTime=0x1d4c641, nFileSizeHigh=0x0, nFileSizeLow=0x18f86, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="PxAgTEg2m.swf", cAlternateFileName="PXAGTE~1.SWF")) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b7a2670, ftCreationTime.dwHighDateTime=0x1d4ce07, ftLastAccessTime.dwLowDateTime=0x79458340, ftLastAccessTime.dwHighDateTime=0x1d4c9fb, ftLastWriteTime.dwLowDateTime=0x79458340, ftLastWriteTime.dwHighDateTime=0x1d4c9fb, nFileSizeHigh=0x0, nFileSizeLow=0xcaf8, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="QvXt.mkv", cAlternateFileName="")) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b92aec0, ftCreationTime.dwHighDateTime=0x1d4ce40, ftLastAccessTime.dwLowDateTime=0xf2ca45c0, ftLastAccessTime.dwHighDateTime=0x1d4ce8d, ftLastWriteTime.dwLowDateTime=0xf2ca45c0, ftLastWriteTime.dwHighDateTime=0x1d4ce8d, nFileSizeHigh=0x0, nFileSizeLow=0x49a3, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="rgIcyANdL2Redj9.flv", cAlternateFileName="RGICYA~1.FLV")) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9469e60, ftCreationTime.dwHighDateTime=0x1d4c9df, ftLastAccessTime.dwLowDateTime=0x18703f70, ftLastAccessTime.dwHighDateTime=0x1d4c680, ftLastWriteTime.dwLowDateTime=0x18703f70, ftLastWriteTime.dwHighDateTime=0x1d4c680, nFileSizeHigh=0x0, nFileSizeLow=0x130aa, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="yeAdMsBU85fIkLbN.mp4", cAlternateFileName="YEADMS~1.MP4")) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9469e60, ftCreationTime.dwHighDateTime=0x1d4c9df, ftLastAccessTime.dwLowDateTime=0x18703f70, ftLastAccessTime.dwHighDateTime=0x1d4c680, ftLastWriteTime.dwLowDateTime=0x18703f70, ftLastWriteTime.dwHighDateTime=0x1d4c680, nFileSizeHigh=0x0, nFileSizeLow=0x130aa, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="yeAdMsBU85fIkLbN.mp4", cAlternateFileName="YEADMS~1.MP4")) returned 0 [0035.234] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x5c4cb0, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x950e7e20, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x950e7e20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Videos", cAlternateFileName="")) returned 0 [0035.234] FindClose (in: hFindFile=0x5c4cb0 | out: hFindFile=0x5c4cb0) returned 1 [0035.234] FindNextFileA (in: hFindFile=0x5c3c68, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x64623838, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0035.234] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x624c6b49, dwReserved1=0x706d2e4e, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0035.235] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x624c6b49, dwReserved1=0x706d2e4e, cFileName="..", cAlternateFileName="")) returned 1 [0035.235] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x624c6b49, dwReserved1=0x706d2e4e, cFileName="Adobe", cAlternateFileName="")) returned 1 [0035.235] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0035.235] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="..", cAlternateFileName="")) returned 1 [0035.235] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0035.235] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.235] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.235] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0035.235] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.235] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.236] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 1 [0035.236] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.236] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.237] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0035.237] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0035.237] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.237] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 1 [0035.237] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 0 [0035.237] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.237] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0035.237] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.237] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 0 [0035.237] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.237] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0035.237] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.237] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="ARM", cAlternateFileName="")) returned 1 [0035.237] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.238] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.238] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 1 [0035.238] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.239] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.239] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 1 [0035.239] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 1 [0035.239] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 1 [0035.239] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 0 [0035.239] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.240] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 0 [0035.240] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.240] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="ARM", cAlternateFileName="")) returned 0 [0035.240] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0035.240] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x706d2e4e, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0035.240] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Application Data\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="ARM", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0035.241] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x706d2e4e, cFileName="Desktop", cAlternateFileName="")) returned 1 [0035.241] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Desktop\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="ARM", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0035.241] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x706d2e4e, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0035.241] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Documents\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="ARM", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0035.241] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x706d2e4e, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0035.241] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Favorites\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e4347, dwReserved1=0x732e766b, cFileName="ARM", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0035.241] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x706d2e4e, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0035.241] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e302e, dwReserved1=0x732e766b, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0035.241] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e302e, dwReserved1=0x732e766b, cFileName="..", cAlternateFileName="")) returned 1 [0035.241] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e302e, dwReserved1=0x732e766b, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1 [0035.241] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.241] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="..", cAlternateFileName="")) returned 1 [0035.241] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="Client", cAlternateFileName="")) returned 1 [0035.242] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.242] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.242] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0035.242] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.242] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.242] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0035.242] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0035.244] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.244] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 1 [0035.244] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 1 [0035.244] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 1 [0035.244] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 1 [0035.245] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 1 [0035.245] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 1 [0035.245] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 1 [0035.245] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 0 [0035.245] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.245] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0035.245] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.245] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0035.246] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.246] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="Client", cAlternateFileName="")) returned 0 [0035.246] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.246] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e302e, dwReserved1=0x732e766b, cFileName="Crypto", cAlternateFileName="")) returned 1 [0035.246] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.246] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="..", cAlternateFileName="")) returned 1 [0035.246] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="DSS", cAlternateFileName="")) returned 1 [0035.246] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.246] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.246] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0035.246] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.246] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.246] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.246] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.247] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0035.247] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.247] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="Keys", cAlternateFileName="")) returned 1 [0035.247] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.247] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.247] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.248] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.248] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="RSA", cAlternateFileName="")) returned 1 [0035.248] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.248] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.248] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0035.248] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.248] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.248] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.248] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.248] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0035.248] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.268] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.268] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 1 [0035.268] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 1 [0035.268] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 0 [0035.268] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.268] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0035.268] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.268] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="RSA", cAlternateFileName="")) returned 0 [0035.268] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.268] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e302e, dwReserved1=0x732e766b, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0035.268] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.269] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="..", cAlternateFileName="")) returned 1 [0035.269] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36313130, dwReserved1=0x49554d5f, cFileName="Device", cAlternateFileName="")) returned 1 [0035.269] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64383561, dwReserved1=0x62643262, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.269] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64383561, dwReserved1=0x62643262, cFileName="..", cAlternateFileName="")) returned 1 [0035.269] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64383561, dwReserved1=0x62643262, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0035.269] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.271] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.271] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0035.271] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20 [0035.271] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.271] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.272] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.274] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.275] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.275] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.275] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.276] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.276] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.276] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.276] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.276] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.276] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.276] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.277] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.277] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.277] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.277] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.277] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.277] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.277] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.278] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.278] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.278] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.278] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.278] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.278] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.278] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.279] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.279] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.279] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.279] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.279] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.279] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.279] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.280] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.280] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.280] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.280] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.280] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.280] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.281] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.281] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.281] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.281] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.281] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.281] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.281] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.282] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.282] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.282] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.282] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.282] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.283] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.283] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.283] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.283] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.283] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.283] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.283] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.284] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.284] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.284] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.284] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.284] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0xad1, lpOverlapped=0x0) returned 1 [0035.284] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0xad1, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0xad1, lpOverlapped=0x0) returned 1 [0035.284] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.284] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.284] CloseHandle (hObject=0xf0) returned 1 [0035.285] CloseHandle (hObject=0xf4) returned 1 [0035.285] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.crypt")) returned 0 [0035.285] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.crypt")) returned 0x20 [0035.285] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="background.png", cAlternateFileName="")) returned 0x5c8fc0 [0035.285] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="background.png", cAlternateFileName="")) returned 0 [0035.285] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.285] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0 [0035.285] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20 [0035.285] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x5d1560, dwReserved1=0x18eed4, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0035.285] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x5d1560, dwReserved1=0x18eed4, cFileName="device.png", cAlternateFileName="")) returned 1 [0035.285] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20 [0035.286] VirtualAlloc (lpAddress=0x32f4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x32f4000 [0035.287] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.287] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.287] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.289] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.290] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.290] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.291] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.291] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.291] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.291] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.291] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.291] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.291] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.292] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.292] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.292] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.292] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.292] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.292] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.292] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.293] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.293] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.293] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0xdc8, lpOverlapped=0x0) returned 1 [0035.293] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0xdc8, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0xdc8, lpOverlapped=0x0) returned 1 [0035.293] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.293] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.293] CloseHandle (hObject=0xf4) returned 1 [0035.293] CloseHandle (hObject=0xf0) returned 1 [0035.293] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.crypt")) returned 0 [0035.293] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.crypt")) returned 0x20 [0035.294] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="device.png", cAlternateFileName="")) returned 0x5c8fc0 [0035.294] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="device.png", cAlternateFileName="")) returned 0 [0035.294] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.294] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0 [0035.294] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20 [0035.294] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0035.294] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20 [0035.294] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.294] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.295] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.297] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.297] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.298] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.298] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.298] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.298] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.298] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.298] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.299] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.299] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.299] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.299] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.299] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.299] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0xc1, lpOverlapped=0x0) returned 1 [0035.299] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0xc1, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0xc1, lpOverlapped=0x0) returned 1 [0035.300] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.300] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.300] CloseHandle (hObject=0xf0) returned 1 [0035.300] CloseHandle (hObject=0xf4) returned 1 [0035.300] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.crypt")) returned 0 [0035.300] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.crypt")) returned 0x20 [0035.300] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="overlay.png", cAlternateFileName="")) returned 0x5c8fc0 [0035.300] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="overlay.png", cAlternateFileName="")) returned 0 [0035.300] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.300] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0 [0035.300] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20 [0035.300] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0035.300] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20 [0035.301] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.301] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.302] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.303] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.304] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.305] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.305] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.305] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.305] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.305] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.305] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.305] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.306] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.306] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.306] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.306] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.306] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.306] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.306] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.307] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.307] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x9d3, lpOverlapped=0x0) returned 1 [0035.307] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x9d3, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x9d3, lpOverlapped=0x0) returned 1 [0035.307] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.307] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.307] CloseHandle (hObject=0xf4) returned 1 [0035.307] CloseHandle (hObject=0xf0) returned 1 [0035.307] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.crypt")) returned 0 [0035.307] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.crypt")) returned 0x20 [0035.307] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="superbar.png", cAlternateFileName="")) returned 0x5c8fc0 [0035.308] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0035.308] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.308] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0 [0035.308] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20 [0035.308] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0035.308] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.308] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64676e67, dwReserved1=0x62643262, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0035.308] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18eed4, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.308] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18eed4, cFileName="..", cAlternateFileName="")) returned 1 [0035.308] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x5d1560, dwReserved1=0x18eed4, cFileName="background.png", cAlternateFileName="")) returned 1 [0035.308] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0035.308] VirtualAlloc (lpAddress=0x32f8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x32f8000 [0035.309] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.309] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.311] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.314] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.314] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.315] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.315] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.315] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.315] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.315] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.315] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.315] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.316] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.316] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.316] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.316] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.316] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.316] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.316] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.317] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.317] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.317] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.317] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.317] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.317] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.317] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.318] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.318] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.318] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.318] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.318] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.318] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.318] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.319] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.319] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.319] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.319] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.319] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.319] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.319] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.320] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.320] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.320] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.320] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.320] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.320] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.321] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.321] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.321] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.321] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.321] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.321] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.322] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.322] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.322] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.322] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.322] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.322] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.322] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.323] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.323] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.323] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.323] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.323] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.323] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0xad1, lpOverlapped=0x0) returned 1 [0035.323] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0xad1, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0xad1, lpOverlapped=0x0) returned 1 [0035.324] ReadFile (in: hFile=0xf0, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.324] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.324] CloseHandle (hObject=0xf0) returned 1 [0035.324] CloseHandle (hObject=0xf4) returned 1 [0035.324] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.crypt")) returned 0 [0035.324] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.crypt")) returned 0x20 [0035.324] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="background.png", cAlternateFileName="")) returned 0x5c8fc0 [0035.324] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="background.png", cAlternateFileName="")) returned 0 [0035.324] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.324] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0 [0035.324] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0035.324] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x5d1560, dwReserved1=0x18eed4, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0035.325] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x5d1560, dwReserved1=0x18eed4, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0035.325] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20 [0035.325] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.325] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.325] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.327] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.328] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.328] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.328] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.328] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.329] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.329] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.329] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.329] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.329] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.329] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.329] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.330] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0035.330] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0xc1, lpOverlapped=0x0) returned 1 [0035.330] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0xc1, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0xc1, lpOverlapped=0x0) returned 1 [0035.330] ReadFile (in: hFile=0xf4, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.330] WriteFile (in: hFile=0xf0, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.330] CloseHandle (hObject=0xf4) returned 1 [0035.330] CloseHandle (hObject=0xf0) returned 1 [0035.330] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.crypt")) returned 0 [0035.330] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.crypt" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.crypt")) returned 0x20 [0035.330] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="watermark.png", cAlternateFileName="")) returned 0x5c8fc0 [0035.330] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0035.331] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.331] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0 [0035.331] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20 [0035.331] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x5d1560, dwReserved1=0x18eed4, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0035.331] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.331] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64676e67, dwReserved1=0x62643262, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0035.331] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.331] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d646161, dwReserved1=0x34373634, cFileName="Task", cAlternateFileName="")) returned 1 [0035.331] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6467676e, dwReserved1=0x62643262, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.331] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6467676e, dwReserved1=0x62643262, cFileName="..", cAlternateFileName="")) returned 1 [0035.331] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6467676e, dwReserved1=0x62643262, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0035.331] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18eed4, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.333] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18eed4, cFileName="..", cAlternateFileName="")) returned 1 [0035.333] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18eed4, cFileName="en-US", cAlternateFileName="")) returned 1 [0035.333] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0035.334] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0035.334] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0035.334] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.334] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64676f6f, dwReserved1=0x62643262, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0035.334] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.336] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="..", cAlternateFileName="")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="en-US", cAlternateFileName="")) returned 1 [0035.336] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0035.336] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0035.336] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x5d156c, dwReserved1=0x18eed4, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0035.336] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64676f6f, dwReserved1=0x62643262, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0035.336] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.336] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d646161, dwReserved1=0x34373634, cFileName="Task", cAlternateFileName="")) returned 0 [0035.337] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.337] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e302e, dwReserved1=0x732e766b, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0035.337] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.337] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0035.337] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 0 [0035.337] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.337] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e302e, dwReserved1=0x732e766b, cFileName="DRM", cAlternateFileName="")) returned 1 [0035.337] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.338] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0035.338] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Server", cAlternateFileName="")) returned 1 [0035.338] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.338] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0035.338] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 0 [0035.338] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.338] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Server", cAlternateFileName="")) returned 0 [0035.338] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.338] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e302e, dwReserved1=0x732e766b, cFileName="eHome", cAlternateFileName="")) returned 1 [0035.338] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.338] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0035.338] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="logs", cAlternateFileName="")) returned 1 [0035.339] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.339] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0035.339] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 0 [0035.339] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.339] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="logs", cAlternateFileName="")) returned 0 [0035.339] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.339] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e302e, dwReserved1=0x732e766b, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0035.339] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.339] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0035.339] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Views", cAlternateFileName="")) returned 1 [0035.339] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.339] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0035.339] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0035.340] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.340] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.340] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.340] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.340] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0035.340] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.340] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Views", cAlternateFileName="")) returned 0 [0035.340] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.340] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d2e302e, dwReserved1=0x732e766b, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0035.340] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.340] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="..", cAlternateFileName="")) returned 1 [0035.340] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0035.340] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1 [0035.340] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0035.340] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.340] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x732e766b, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0035.341] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.341] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="..", cAlternateFileName="")) returned 1 [0035.341] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="..", cAlternateFileName="")) returned 0 [0035.341] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.341] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x732e766b, cFileName="MF", cAlternateFileName="")) returned 1 [0035.341] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.341] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="..", cAlternateFileName="")) returned 1 [0035.341] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0035.341] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0035.341] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0035.341] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.341] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x732e766b, cFileName="MSDN", cAlternateFileName="")) returned 1 [0035.341] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.345] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="..", cAlternateFileName="")) returned 1 [0035.345] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="8.0", cAlternateFileName="")) returned 1 [0035.345] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.345] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0035.345] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 0 [0035.345] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.345] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="8.0", cAlternateFileName="")) returned 0 [0035.345] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.347] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x732e766b, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0035.347] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.356] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="..", cAlternateFileName="")) returned 1 [0035.356] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0035.356] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.357] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0035.357] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 0 [0035.357] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.357] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0035.357] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.357] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x732e766b, cFileName="Network", cAlternateFileName="")) returned 1 [0035.357] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.358] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="..", cAlternateFileName="")) returned 1 [0035.358] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0035.358] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.358] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0035.358] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 0 [0035.358] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.358] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0035.358] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.358] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0035.358] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="qmgr0.dat", cAlternateFileName="")) returned 1 [0035.359] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="qmgr1.dat", cAlternateFileName="")) returned 1 [0035.359] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0 [0035.359] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.359] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0035.359] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.359] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x732e766b, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0035.359] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.361] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="..", cAlternateFileName="")) returned 1 [0035.361] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1 [0035.361] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1 [0035.361] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0035.361] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="MySite.ico", cAlternateFileName="")) returned 1 [0035.361] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1 [0035.361] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1 [0035.361] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1 [0035.361] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.362] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0035.362] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x626f6f63, cFileName="1036", cAlternateFileName="")) returned 1 [0035.362] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.364] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1 [0035.365] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1 [0035.366] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1 [0035.366] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1 [0035.366] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1 [0035.366] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0035.366] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.366] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="3082", cAlternateFileName="")) returned 1 [0035.366] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.368] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xb960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x39960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x47d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x248aaf00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x248aaf00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x16f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25bbdc00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25bbdc00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2b2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3564d600, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3564d600, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63b88300, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63b88300, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62875600, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62875600, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x35960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x9f560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x315ed100, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x315ed100, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a4a9400, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1a4a9400, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0xd160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19196700, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x19196700, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0x43560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0035.369] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57655500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57655500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x87f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0035.370] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2720b500, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2720b500, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x57f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0035.370] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x94d0df00, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x94d0df00, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1 [0035.370] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca190500, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xca190500, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1 [0035.370] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1 [0035.370] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70273800, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x70273800, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x73960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1 [0035.370] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1789a00, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa1789a00, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x24360, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1 [0035.370] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a9c700, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2a9c700, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x110b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1 [0035.370] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x23960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1 [0035.370] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x126760, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1 [0035.370] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1 [0035.370] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0035.370] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.371] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="3082", cAlternateFileName="")) returned 0 [0035.371] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.371] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 0 [0035.371] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.371] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x536d6165, dwReserved1=0x2e657469, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0035.371] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.371] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="..", cAlternateFileName="")) returned 1 [0035.371] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="Cache", cAlternateFileName="")) returned 1 [0035.371] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.371] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="..", cAlternateFileName="")) returned 1 [0035.371] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="cache.dat", cAlternateFileName="")) returned 1 [0035.372] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="cache.dat", cAlternateFileName="")) returned 0 [0035.372] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.372] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="tokens.dat", cAlternateFileName="")) returned 1 [0035.372] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="tokens.dat", cAlternateFileName="")) returned 0 [0035.372] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.372] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x536d6165, dwReserved1=0x2e657469, cFileName="RAC", cAlternateFileName="")) returned 1 [0035.372] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.372] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="..", cAlternateFileName="")) returned 1 [0035.372] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="Outbound", cAlternateFileName="")) returned 1 [0035.372] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.372] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="..", cAlternateFileName="")) returned 1 [0035.372] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="..", cAlternateFileName="")) returned 0 [0035.372] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.372] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x959169c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x959169c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77656956, dwReserved1=0x6f6f5273, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1 [0035.372] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x959169c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x959169c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.373] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x959169c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x959169c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="..", cAlternateFileName="")) returned 1 [0035.373] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x959169c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9593cb20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 1 [0035.373] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x959169c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9593cb20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 0 [0035.373] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.373] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x959169c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x959169c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e657361, dwReserved1=0x6f666473, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1 [0035.373] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x959169c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x959169c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.373] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x959169c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x959169c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="..", cAlternateFileName="")) returned 1 [0035.373] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb35800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xecb35800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xbddb7d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 1 [0035.373] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 1 [0035.373] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 0 [0035.373] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.373] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x95a474c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x95a474c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461642e, dwReserved1=0x6f666473, cFileName="Temp", cAlternateFileName="")) returned 1 [0035.374] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x95a474c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x95a474c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.374] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x95a474c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x95a474c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="..", cAlternateFileName="")) returned 1 [0035.374] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95a21360, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x95a21360, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x95a21360, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="sql3274.tmp", cAlternateFileName="")) returned 1 [0035.374] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95a474c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x95a474c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x95a474c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="sql3285.tmp", cAlternateFileName="")) returned 1 [0035.374] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95a474c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x95a474c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x95a474c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="sql3285.tmp", cAlternateFileName="")) returned 0 [0035.374] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.374] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x95a474c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x95a474c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461642e, dwReserved1=0x6f666473, cFileName="Temp", cAlternateFileName="")) returned 0 [0035.374] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.374] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x536d6174, dwReserved1=0x2e657469, cFileName="Search", cAlternateFileName="")) returned 1 [0035.374] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461642e, dwReserved1=0x6f666473, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.375] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461642e, dwReserved1=0x6f666473, cFileName="..", cAlternateFileName="")) returned 1 [0035.375] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461642e, dwReserved1=0x6f666473, cFileName="Data", cAlternateFileName="")) returned 1 [0035.375] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.375] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="..", cAlternateFileName="")) returned 1 [0035.375] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1 [0035.375] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.376] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.376] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0035.376] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0035.378] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.378] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config", cAlternateFileName="")) returned 1 [0035.378] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0035.379] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.379] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.379] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.379] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GatherLogs", cAlternateFileName="GATHER~1")) returned 1 [0035.379] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0035.380] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.380] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1 [0035.380] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0035.380] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.380] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.Crwl", cAlternateFileName="SYSTEM~1.CRW")) returned 1 [0035.381] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 1 [0035.381] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 0 [0035.381] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.381] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0 [0035.381] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.381] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.chk", cAlternateFileName="")) returned 1 [0035.381] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295a0600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295a0600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSS.log", cAlternateFileName="")) returned 1 [0035.381] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295c6760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295c6760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00001.jrs", cAlternateFileName="MSSRES~1.JRS")) returned 1 [0035.381] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295ec8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295ec8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSres00002.jrs", cAlternateFileName="MSSRES~2.JRS")) returned 1 [0035.381] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects", cAlternateFileName="")) returned 1 [0035.381] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x672e312e, dwReserved1=0x726874, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0035.381] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x672e312e, dwReserved1=0x726874, cFileName="..", cAlternateFileName="")) returned 1 [0035.381] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x672e312e, dwReserved1=0x726874, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1 [0035.381] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0035.382] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.382] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexer", cAlternateFileName="")) returned 1 [0035.382] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0035.383] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.383] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiFiles", cAlternateFileName="")) returned 1 [0035.383] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0035.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299f0de0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299f0de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.000", cAlternateFileName="")) returned 1 [0035.385] VirtualAlloc (lpAddress=0x32fc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x32fc000 [0035.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.001", cAlternateFileName="")) returned 1 [0035.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0001.002", cAlternateFileName="")) returned 1 [0035.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.000", cAlternateFileName="")) returned 1 [0035.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.001", cAlternateFileName="")) returned 1 [0035.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAB0002.002", cAlternateFileName="")) returned 1 [0035.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299f0de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.000", cAlternateFileName="")) returned 1 [0035.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.001", cAlternateFileName="")) returned 1 [0035.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiAD0001.002", cAlternateFileName="")) returned 1 [0035.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.000", cAlternateFileName="")) returned 1 [0035.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.001", cAlternateFileName="")) returned 1 [0035.386] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDEX.002", cAlternateFileName="")) returned 1 [0035.386] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 1 [0035.386] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 0 [0035.386] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0035.386] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiFiles", cAlternateFileName="")) returned 0 [0035.386] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0035.386] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PropMap", cAlternateFileName="")) returned 1 [0035.386] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0035.387] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.387] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x41, dwReserved1=0x0, cFileName="CiPT0000.000", cAlternateFileName="")) returned 1 [0035.387] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x41, dwReserved1=0x0, cFileName="CiPT0000.001", cAlternateFileName="")) returned 1 [0035.387] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x41, dwReserved1=0x0, cFileName="CiPT0000.002", cAlternateFileName="")) returned 1 [0035.387] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0035.388] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0035.388] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0035.388] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.388] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.388] VirtualFree (lpAddress=0x32fc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0035.388] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.389] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.389] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73726a2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.389] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.389] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.389] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.389] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74616473, dwReserved1=0x6f666473, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.389] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.391] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.392] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.392] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74706d62, dwReserved1=0x6f666473, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.392] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.392] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74706d62, dwReserved1=0x6f666473, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.393] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0035.393] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74706d62, dwReserved1=0x6f666473, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0035.393] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.393] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.394] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.394] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.394] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.395] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.396] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.396] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.396] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.396] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.396] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.397] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.398] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.400] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini")) returned 0x26 [0035.400] VirtualAlloc (lpAddress=0x32fc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x32fc000 [0035.401] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0035.401] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.402] ReadFile (in: hFile=0x114, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x264, lpOverlapped=0x0) returned 1 [0035.403] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x264, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x264, lpOverlapped=0x0) returned 1 [0035.404] ReadFile (in: hFile=0x114, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0035.404] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0035.404] CloseHandle (hObject=0x114) returned 1 [0035.404] CloseHandle (hObject=0xf0) returned 1 [0035.405] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini.crypt")) returned 0 [0035.405] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini.crypt")) returned 0x2020 [0035.405] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0035.406] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0035.406] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.406] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini")) returned 1 [0035.407] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini")) returned 0xffffffff [0035.407] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 1 [0035.407] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 1 [0035.407] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 1 [0035.407] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 1 [0035.407] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 1 [0035.407] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 1 [0035.407] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 1 [0035.407] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 1 [0035.407] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 1 [0035.407] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 1 [0035.407] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 0 [0035.407] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.407] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616d772e, dwReserved1=0x736c6d6c, cFileName="Sqm", cAlternateFileName="")) returned 1 [0035.407] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.408] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.408] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest", cAlternateFileName="")) returned 1 [0035.408] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.408] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.408] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.408] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.408] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1 [0035.408] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.408] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.408] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.408] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.408] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1 [0035.408] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.409] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.409] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0035.409] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.409] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 0 [0035.409] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0035.409] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616d772e, dwReserved1=0x736c6d6c, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0035.409] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0035.409] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.409] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 1 [0035.409] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk")) returned 0x20 [0035.410] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.410] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0035.411] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x502, lpOverlapped=0x0) returned 1 [0035.413] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x502, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x502, lpOverlapped=0x0) returned 1 [0035.414] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0035.414] WriteFile (in: hFile=0x114, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0035.414] CloseHandle (hObject=0xf0) returned 1 [0035.414] CloseHandle (hObject=0x114) returned 1 [0035.414] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk.crypt")) returned 0 [0035.414] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk.crypt")) returned 0x20 [0035.414] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 0x5c8f80 [0035.415] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 0 [0035.415] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.415] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk")) returned 1 [0035.416] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk")) returned 0xffffffff [0035.416] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x5c8d98, dwReserved1=0x18f13c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0035.416] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini")) returned 0x26 [0035.416] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0035.416] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0035.417] ReadFile (in: hFile=0x114, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1ba, lpOverlapped=0x0) returned 1 [0035.418] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1ba, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1ba, lpOverlapped=0x0) returned 1 [0035.419] ReadFile (in: hFile=0x114, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0035.419] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0035.419] CloseHandle (hObject=0x114) returned 1 [0035.419] CloseHandle (hObject=0xf0) returned 1 [0035.419] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini.crypt")) returned 0 [0035.419] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini.crypt")) returned 0x20 [0035.419] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f80 [0035.420] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0035.420] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0035.420] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini")) returned 1 [0035.421] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini")) returned 0xffffffff [0035.421] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0035.421] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0035.421] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.421] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0035.421] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d0061, dwReserved1=0x2e0073, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0035.421] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d0061, dwReserved1=0x2e0073, cFileName="..", cAlternateFileName="")) returned 1 [0035.421] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d0061, dwReserved1=0x2e0073, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0035.421] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0035.421] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.421] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0035.421] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 0x26 [0035.422] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.422] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.424] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x172, lpOverlapped=0x0) returned 1 [0035.425] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x172, lpOverlapped=0x0) returned 1 [0035.425] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.425] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.426] CloseHandle (hObject=0xfc) returned 1 [0035.426] CloseHandle (hObject=0x108) returned 1 [0035.426] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.crypt")) returned 0 [0035.426] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.crypt")) returned 0x20 [0035.426] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c9040 [0035.426] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0035.426] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.426] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 1 [0035.427] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 0xffffffff [0035.427] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x5c8d98, dwReserved1=0x18ea04, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 1 [0035.427] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk")) returned 0x20 [0035.428] VirtualAlloc (lpAddress=0x3300000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3300000 [0035.429] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.429] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.430] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x56c, lpOverlapped=0x0) returned 1 [0035.431] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x56c, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x56c, lpOverlapped=0x0) returned 1 [0035.432] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.432] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.432] CloseHandle (hObject=0x108) returned 1 [0035.432] CloseHandle (hObject=0xfc) returned 1 [0035.432] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk.crypt")) returned 0 [0035.433] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk.crypt")) returned 0x20 [0035.433] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 0x5c9040 [0035.433] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 0 [0035.433] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.433] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk")) returned 1 [0035.434] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk")) returned 0xffffffff [0035.434] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x5c8d98, dwReserved1=0x18ea04, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 0 [0035.434] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.434] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 1 [0035.434] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk")) returned 0x20 [0035.434] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.434] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.435] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4ce, lpOverlapped=0x0) returned 1 [0035.436] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4ce, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4ce, lpOverlapped=0x0) returned 1 [0035.437] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.437] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.437] CloseHandle (hObject=0xf4) returned 1 [0035.437] CloseHandle (hObject=0xfc) returned 1 [0035.438] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk.crypt")) returned 0 [0035.438] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk.crypt")) returned 0x20 [0035.438] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 0x5c9000 [0035.438] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 0 [0035.438] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.438] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk")) returned 1 [0035.439] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk")) returned 0xffffffff [0035.439] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0035.439] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0x26 [0035.440] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.440] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.441] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x73e, lpOverlapped=0x0) returned 1 [0035.441] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x73e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x73e, lpOverlapped=0x0) returned 1 [0035.442] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.442] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.442] CloseHandle (hObject=0xfc) returned 1 [0035.442] CloseHandle (hObject=0xf4) returned 1 [0035.443] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypt")) returned 0 [0035.443] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypt")) returned 0x20 [0035.443] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0035.443] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0035.443] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.443] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 1 [0035.444] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0xffffffff [0035.444] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 1 [0035.444] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk")) returned 0x20 [0035.444] VirtualAlloc (lpAddress=0x3304000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3304000 [0035.445] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.445] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.446] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4f2, lpOverlapped=0x0) returned 1 [0035.447] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4f2, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4f2, lpOverlapped=0x0) returned 1 [0035.448] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.448] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.448] CloseHandle (hObject=0xf4) returned 1 [0035.448] CloseHandle (hObject=0xfc) returned 1 [0035.448] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk.crypt")) returned 0 [0035.449] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk.crypt")) returned 0x20 [0035.449] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 0x5c9000 [0035.449] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 0 [0035.449] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.449] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk")) returned 1 [0035.450] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk")) returned 0xffffffff [0035.450] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 1 [0035.450] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk")) returned 0x20 [0035.451] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.451] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.452] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x554, lpOverlapped=0x0) returned 1 [0035.454] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x554, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x554, lpOverlapped=0x0) returned 1 [0035.455] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.455] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.455] CloseHandle (hObject=0xfc) returned 1 [0035.455] CloseHandle (hObject=0xf4) returned 1 [0035.457] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.crypt")) returned 0 [0035.458] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.crypt")) returned 0x20 [0035.458] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 0x5c9000 [0035.458] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 0 [0035.458] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.458] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk")) returned 1 [0035.459] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk")) returned 0xffffffff [0035.459] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 1 [0035.459] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk")) returned 0x20 [0035.459] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.460] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.460] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4d6, lpOverlapped=0x0) returned 1 [0035.461] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4d6, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4d6, lpOverlapped=0x0) returned 1 [0035.462] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.462] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.462] CloseHandle (hObject=0xf4) returned 1 [0035.462] CloseHandle (hObject=0xfc) returned 1 [0035.463] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk.crypt")) returned 0 [0035.463] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk.crypt")) returned 0x20 [0035.463] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 0x5c9000 [0035.463] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 0 [0035.463] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.463] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk")) returned 1 [0035.464] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk")) returned 0xffffffff [0035.464] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 1 [0035.464] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk")) returned 0x20 [0035.464] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.465] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.465] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4da, lpOverlapped=0x0) returned 1 [0035.466] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4da, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4da, lpOverlapped=0x0) returned 1 [0035.467] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.468] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.468] CloseHandle (hObject=0xfc) returned 1 [0035.468] CloseHandle (hObject=0xf4) returned 1 [0035.468] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk.crypt")) returned 0 [0035.468] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk.crypt")) returned 0x20 [0035.468] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 0x5c9000 [0035.468] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 0 [0035.468] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.468] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk")) returned 1 [0035.469] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk")) returned 0xffffffff [0035.469] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paint.lnk", cAlternateFileName="")) returned 1 [0035.469] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk")) returned 0x20 [0035.469] VirtualAlloc (lpAddress=0x3308000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3308000 [0035.470] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.470] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.470] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4da, lpOverlapped=0x0) returned 1 [0035.471] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4da, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4da, lpOverlapped=0x0) returned 1 [0035.472] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.472] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.472] CloseHandle (hObject=0xf4) returned 1 [0035.472] CloseHandle (hObject=0xfc) returned 1 [0035.472] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.crypt")) returned 0 [0035.472] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.crypt")) returned 0x20 [0035.473] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Paint.lnk", cAlternateFileName="")) returned 0x5c9000 [0035.473] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Paint.lnk", cAlternateFileName="")) returned 0 [0035.473] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.473] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk")) returned 1 [0035.474] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk")) returned 0xffffffff [0035.474] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0035.474] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk")) returned 0x20 [0035.474] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.474] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.475] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x557, lpOverlapped=0x0) returned 1 [0035.482] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x557, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x557, lpOverlapped=0x0) returned 1 [0035.483] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.483] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.484] CloseHandle (hObject=0xfc) returned 1 [0035.484] CloseHandle (hObject=0xf4) returned 1 [0035.484] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.crypt")) returned 0 [0035.485] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.crypt")) returned 0x20 [0035.485] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0x5c9000 [0035.485] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0 [0035.485] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.485] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk")) returned 1 [0035.486] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk")) returned 0xffffffff [0035.486] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 1 [0035.486] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk")) returned 0x20 [0035.486] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.486] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.487] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4f8, lpOverlapped=0x0) returned 1 [0035.488] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4f8, lpOverlapped=0x0) returned 1 [0035.489] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.489] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.489] CloseHandle (hObject=0xf4) returned 1 [0035.489] CloseHandle (hObject=0xfc) returned 1 [0035.489] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.crypt")) returned 0 [0035.489] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.crypt")) returned 0x20 [0035.490] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 0x5c9000 [0035.490] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 0 [0035.490] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.490] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk")) returned 1 [0035.491] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk")) returned 0xffffffff [0035.491] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 1 [0035.491] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk")) returned 0x20 [0035.491] VirtualAlloc (lpAddress=0x330c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x330c000 [0035.492] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.492] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.493] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x532, lpOverlapped=0x0) returned 1 [0035.494] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x532, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x532, lpOverlapped=0x0) returned 1 [0035.495] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.495] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.495] CloseHandle (hObject=0xfc) returned 1 [0035.495] CloseHandle (hObject=0xf4) returned 1 [0035.495] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk.crypt")) returned 0 [0035.495] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk.crypt")) returned 0x20 [0035.495] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 0x5c9000 [0035.496] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 0 [0035.496] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.496] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk")) returned 1 [0035.497] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk")) returned 0xffffffff [0035.497] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 1 [0035.497] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk")) returned 0x20 [0035.497] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.497] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.497] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x547, lpOverlapped=0x0) returned 1 [0035.498] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x547, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x547, lpOverlapped=0x0) returned 1 [0035.499] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.499] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.499] CloseHandle (hObject=0xf4) returned 1 [0035.499] CloseHandle (hObject=0xfc) returned 1 [0035.500] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk.crypt")) returned 0 [0035.500] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk.crypt")) returned 0x20 [0035.500] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 0x5c9000 [0035.500] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 0 [0035.500] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.500] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk")) returned 1 [0035.501] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk")) returned 0xffffffff [0035.501] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 1 [0035.501] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk")) returned 0x20 [0035.501] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.502] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.502] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4e6, lpOverlapped=0x0) returned 1 [0035.504] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4e6, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4e6, lpOverlapped=0x0) returned 1 [0035.505] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.505] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.505] CloseHandle (hObject=0xfc) returned 1 [0035.505] CloseHandle (hObject=0xf4) returned 1 [0035.505] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk.crypt")) returned 0 [0035.505] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk.crypt")) returned 0x20 [0035.505] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 0x5c9000 [0035.505] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 0 [0035.505] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.505] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk")) returned 1 [0035.506] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk")) returned 0xffffffff [0035.506] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0035.506] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0035.507] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.507] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0xa8, dwReserved1=0x0, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 1 [0035.507] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk")) returned 0x20 [0035.507] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.507] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.508] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x4e0, lpOverlapped=0x0) returned 1 [0035.509] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x4e0, lpOverlapped=0x0) returned 1 [0035.510] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.510] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.510] CloseHandle (hObject=0xfc) returned 1 [0035.510] CloseHandle (hObject=0x108) returned 1 [0035.510] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.crypt")) returned 0 [0035.510] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.crypt")) returned 0x20 [0035.510] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 0x5c9040 [0035.511] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 0 [0035.511] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.511] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk")) returned 1 [0035.512] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk")) returned 0xffffffff [0035.512] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0035.512] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 0x26 [0035.512] VirtualAlloc (lpAddress=0x3310000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3310000 [0035.512] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.512] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.513] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x53a, lpOverlapped=0x0) returned 1 [0035.514] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x53a, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x53a, lpOverlapped=0x0) returned 1 [0035.515] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.515] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.515] CloseHandle (hObject=0x108) returned 1 [0035.515] CloseHandle (hObject=0xfc) returned 1 [0035.515] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.crypt")) returned 0 [0035.515] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.crypt")) returned 0x20 [0035.515] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c9040 [0035.515] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0035.515] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.515] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 1 [0035.516] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 0xffffffff [0035.516] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x5c8d98, dwReserved1=0x18ea04, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 1 [0035.516] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk")) returned 0x20 [0035.518] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.519] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.520] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x50a, lpOverlapped=0x0) returned 1 [0035.521] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x50a, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x50a, lpOverlapped=0x0) returned 1 [0035.522] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.522] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.522] CloseHandle (hObject=0xfc) returned 1 [0035.522] CloseHandle (hObject=0x108) returned 1 [0035.522] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk.crypt")) returned 0 [0035.522] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk.crypt")) returned 0x20 [0035.522] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 0x5c9040 [0035.522] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 0 [0035.522] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.522] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk")) returned 1 [0035.523] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk")) returned 0xffffffff [0035.523] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x5c8d98, dwReserved1=0x18ea04, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 1 [0035.523] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk")) returned 0x20 [0035.524] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.524] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.524] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x4e4, lpOverlapped=0x0) returned 1 [0035.526] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x4e4, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x4e4, lpOverlapped=0x0) returned 1 [0035.527] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.527] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.527] CloseHandle (hObject=0x108) returned 1 [0035.527] CloseHandle (hObject=0xfc) returned 1 [0035.527] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk.crypt")) returned 0 [0035.527] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk.crypt")) returned 0x20 [0035.527] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 0x5c9040 [0035.527] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 0 [0035.527] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.528] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk")) returned 1 [0035.528] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk")) returned 0xffffffff [0035.528] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 1 [0035.528] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk")) returned 0x20 [0035.529] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.529] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.530] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x4da, lpOverlapped=0x0) returned 1 [0035.531] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x4da, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x4da, lpOverlapped=0x0) returned 1 [0035.532] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.532] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.532] CloseHandle (hObject=0xfc) returned 1 [0035.532] CloseHandle (hObject=0x108) returned 1 [0035.532] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk.crypt")) returned 0 [0035.533] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk.crypt")) returned 0x20 [0035.533] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 0x5c9040 [0035.533] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 0 [0035.533] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.533] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk")) returned 1 [0035.534] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk")) returned 0xffffffff [0035.534] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0035.534] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk")) returned 0x20 [0035.534] VirtualAlloc (lpAddress=0x3314000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3314000 [0035.535] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.535] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.535] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x4e2, lpOverlapped=0x0) returned 1 [0035.537] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x4e2, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x4e2, lpOverlapped=0x0) returned 1 [0035.538] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.538] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.538] CloseHandle (hObject=0x108) returned 1 [0035.538] CloseHandle (hObject=0xfc) returned 1 [0035.538] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk.crypt")) returned 0 [0035.538] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk.crypt")) returned 0x20 [0035.538] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 0x5c9040 [0035.538] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 0 [0035.538] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.538] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk")) returned 1 [0035.539] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk")) returned 0xffffffff [0035.539] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 1 [0035.539] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk")) returned 0x20 [0035.543] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.543] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.544] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x4de, lpOverlapped=0x0) returned 1 [0035.545] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x4de, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x4de, lpOverlapped=0x0) returned 1 [0035.546] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.546] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.546] CloseHandle (hObject=0xfc) returned 1 [0035.546] CloseHandle (hObject=0x108) returned 1 [0035.546] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk.crypt")) returned 0 [0035.546] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk.crypt")) returned 0x20 [0035.547] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 0x5c9040 [0035.547] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 0 [0035.547] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.547] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk")) returned 1 [0035.548] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk")) returned 0xffffffff [0035.548] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0035.548] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk")) returned 0x20 [0035.548] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.548] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.549] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x4f4, lpOverlapped=0x0) returned 1 [0035.550] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x4f4, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x4f4, lpOverlapped=0x0) returned 1 [0035.551] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.551] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.551] CloseHandle (hObject=0x108) returned 1 [0035.551] CloseHandle (hObject=0xfc) returned 1 [0035.552] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk.crypt")) returned 0 [0035.552] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk.crypt")) returned 0x20 [0035.552] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 0x5c9040 [0035.552] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 0 [0035.552] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.552] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk")) returned 1 [0035.553] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk")) returned 0xffffffff [0035.553] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0035.553] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk")) returned 0x20 [0035.555] VirtualAlloc (lpAddress=0x3318000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3318000 [0035.555] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.555] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.556] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x528, lpOverlapped=0x0) returned 1 [0035.598] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x528, lpOverlapped=0x0) returned 1 [0035.599] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.599] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.599] CloseHandle (hObject=0xfc) returned 1 [0035.599] CloseHandle (hObject=0x108) returned 1 [0035.600] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk.crypt")) returned 0 [0035.600] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk.crypt")) returned 0x20 [0035.600] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x5c9040 [0035.600] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0035.600] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.600] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk")) returned 1 [0035.601] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk")) returned 0xffffffff [0035.601] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0035.602] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk")) returned 0x20 [0035.602] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.603] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.603] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x524, lpOverlapped=0x0) returned 1 [0035.605] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x524, lpOverlapped=0x0) returned 1 [0035.606] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.606] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.606] CloseHandle (hObject=0x108) returned 1 [0035.606] CloseHandle (hObject=0xfc) returned 1 [0035.606] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk.crypt")) returned 0 [0035.606] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk.crypt")) returned 0x20 [0035.606] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x5c9040 [0035.606] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0035.606] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.606] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk")) returned 1 [0035.607] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk")) returned 0xffffffff [0035.607] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0035.607] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.607] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72542079, dwReserved1=0x66736e61, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0035.607] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0035.608] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="..", cAlternateFileName="")) returned 1 [0035.608] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0035.608] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini")) returned 0x26 [0035.608] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.608] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.609] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x157, lpOverlapped=0x0) returned 1 [0035.609] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x157, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x157, lpOverlapped=0x0) returned 1 [0035.610] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.610] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.610] CloseHandle (hObject=0xfc) returned 1 [0035.610] CloseHandle (hObject=0x108) returned 1 [0035.610] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini.crypt")) returned 0 [0035.611] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini.crypt")) returned 0x20 [0035.611] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c9040 [0035.611] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0035.611] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.611] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini")) returned 1 [0035.612] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini")) returned 0xffffffff [0035.612] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x811d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 1 [0035.612] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk")) returned 0x20 [0035.612] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.612] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.613] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x59c, lpOverlapped=0x0) returned 1 [0035.614] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x59c, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x59c, lpOverlapped=0x0) returned 1 [0035.615] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.615] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.615] CloseHandle (hObject=0x108) returned 1 [0035.615] CloseHandle (hObject=0xfc) returned 1 [0035.615] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk.crypt")) returned 0 [0035.616] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk.crypt")) returned 0x20 [0035.616] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x811d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 0x5c9040 [0035.616] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x811d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 0 [0035.616] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.616] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk")) returned 1 [0035.617] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk")) returned 0xffffffff [0035.617] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8126b520, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.lnk", cAlternateFileName="")) returned 1 [0035.617] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk")) returned 0x20 [0035.617] VirtualAlloc (lpAddress=0x331c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x331c000 [0035.618] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.618] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.618] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x56a, lpOverlapped=0x0) returned 1 [0035.620] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x56a, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x56a, lpOverlapped=0x0) returned 1 [0035.621] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.621] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.621] CloseHandle (hObject=0xfc) returned 1 [0035.621] CloseHandle (hObject=0x108) returned 1 [0035.621] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk.crypt")) returned 0 [0035.621] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk.crypt")) returned 0x20 [0035.621] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8126b520, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="TabTip.lnk", cAlternateFileName="")) returned 0x5c9040 [0035.621] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8126b520, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="TabTip.lnk", cAlternateFileName="")) returned 0 [0035.622] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.622] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk")) returned 1 [0035.622] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk")) returned 0xffffffff [0035.622] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0035.623] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk")) returned 0x20 [0035.623] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.623] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.624] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x524, lpOverlapped=0x0) returned 1 [0035.625] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x524, lpOverlapped=0x0) returned 1 [0035.626] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.626] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.626] CloseHandle (hObject=0x108) returned 1 [0035.626] CloseHandle (hObject=0xfc) returned 1 [0035.626] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.crypt")) returned 0 [0035.627] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.crypt")) returned 0x20 [0035.627] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x5c9040 [0035.627] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0035.627] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.627] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk")) returned 1 [0035.628] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk")) returned 0xffffffff [0035.628] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0035.628] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.628] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x6c616e72, dwReserved1=0x6b6e6c2e, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 1 [0035.628] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk")) returned 0x20 [0035.628] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.628] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.629] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x62b, lpOverlapped=0x0) returned 1 [0035.630] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x62b, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x62b, lpOverlapped=0x0) returned 1 [0035.630] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.631] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.631] CloseHandle (hObject=0xf4) returned 1 [0035.631] CloseHandle (hObject=0xfc) returned 1 [0035.631] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk.crypt")) returned 0 [0035.631] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk.crypt")) returned 0x20 [0035.631] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 0x5c9000 [0035.631] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 0 [0035.631] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.631] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk")) returned 1 [0035.632] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk")) returned 0xffffffff [0035.632] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0035.632] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0035.632] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.632] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xae, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0035.632] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini")) returned 0x26 [0035.632] VirtualAlloc (lpAddress=0x3320000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3320000 [0035.633] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.633] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.634] ReadFile (in: hFile=0xf4, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xd8, lpOverlapped=0x0) returned 1 [0035.634] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xd8, lpOverlapped=0x0) returned 1 [0035.635] ReadFile (in: hFile=0xf4, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.635] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.635] CloseHandle (hObject=0xf4) returned 1 [0035.635] CloseHandle (hObject=0x108) returned 1 [0035.635] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini.crypt")) returned 0 [0035.636] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini.crypt")) returned 0x20 [0035.636] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9040 [0035.636] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0035.636] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.636] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini")) returned 1 [0035.637] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini")) returned 0xffffffff [0035.637] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0035.637] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk")) returned 0x20 [0035.637] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.638] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.638] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x7c5, lpOverlapped=0x0) returned 1 [0035.646] WriteFile (in: hFile=0xf4, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x7c5, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x7c5, lpOverlapped=0x0) returned 1 [0035.646] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.646] WriteFile (in: hFile=0xf4, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.647] CloseHandle (hObject=0x108) returned 1 [0035.647] CloseHandle (hObject=0xf4) returned 1 [0035.647] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk.crypt")) returned 0 [0035.647] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk.crypt")) returned 0x20 [0035.647] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x5c9040 [0035.647] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0035.647] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.647] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk")) returned 1 [0035.648] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk")) returned 0xffffffff [0035.649] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0035.649] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk")) returned 0x20 [0035.649] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.649] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.650] ReadFile (in: hFile=0xf4, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x5bc, lpOverlapped=0x0) returned 1 [0035.652] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x5bc, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x5bc, lpOverlapped=0x0) returned 1 [0035.653] ReadFile (in: hFile=0xf4, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.653] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.653] CloseHandle (hObject=0xf4) returned 1 [0035.653] CloseHandle (hObject=0x108) returned 1 [0035.653] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk.crypt")) returned 0 [0035.653] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk.crypt")) returned 0x20 [0035.653] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0x5c9040 [0035.653] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0 [0035.653] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.653] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk")) returned 1 [0035.654] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk")) returned 0xffffffff [0035.654] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d750717, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0035.654] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk")) returned 0x20 [0035.656] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.656] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.656] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x5bc, lpOverlapped=0x0) returned 1 [0035.658] WriteFile (in: hFile=0xf4, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x5bc, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x5bc, lpOverlapped=0x0) returned 1 [0035.658] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.658] WriteFile (in: hFile=0xf4, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.659] CloseHandle (hObject=0x108) returned 1 [0035.659] CloseHandle (hObject=0xf4) returned 1 [0035.659] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk.crypt")) returned 0 [0035.659] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk.crypt")) returned 0x20 [0035.659] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d750717, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0x5c9040 [0035.659] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d750717, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0 [0035.659] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.659] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk")) returned 1 [0035.660] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk")) returned 0xffffffff [0035.660] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0035.660] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk")) returned 0x20 [0035.661] VirtualAlloc (lpAddress=0x3324000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3324000 [0035.661] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0035.661] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.662] ReadFile (in: hFile=0xf4, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x76b, lpOverlapped=0x0) returned 1 [0035.663] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x76b, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x76b, lpOverlapped=0x0) returned 1 [0035.664] ReadFile (in: hFile=0xf4, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.664] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0035.664] CloseHandle (hObject=0xf4) returned 1 [0035.664] CloseHandle (hObject=0x108) returned 1 [0035.664] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk.crypt")) returned 0 [0035.664] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk.crypt")) returned 0x20 [0035.665] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x5c9040 [0035.665] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0035.665] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0035.665] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk")) returned 1 [0035.666] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk")) returned 0xffffffff [0035.666] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0035.666] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.666] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x68537265, dwReserved1=0x2e6c6c65, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 1 [0035.666] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk")) returned 0x20 [0035.666] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.666] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.667] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x52a, lpOverlapped=0x0) returned 1 [0035.669] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x52a, lpOverlapped=0x0) returned 1 [0035.670] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.670] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.670] CloseHandle (hObject=0xfc) returned 1 [0035.670] CloseHandle (hObject=0x108) returned 1 [0035.670] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.crypt")) returned 0 [0035.671] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.crypt")) returned 0x20 [0035.671] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0x5c9000 [0035.671] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0 [0035.671] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.671] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk")) returned 1 [0035.672] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk")) returned 0xffffffff [0035.672] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x68537265, dwReserved1=0x2e6c6c65, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0 [0035.672] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.672] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68537265, dwReserved1=0x6e6c6c65, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0035.672] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0035.672] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.672] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 1 [0035.672] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk")) returned 0x20 [0035.673] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.673] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.673] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4da, lpOverlapped=0x0) returned 1 [0035.675] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4da, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4da, lpOverlapped=0x0) returned 1 [0035.676] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.676] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.676] CloseHandle (hObject=0x108) returned 1 [0035.676] CloseHandle (hObject=0xfc) returned 1 [0035.676] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.crypt")) returned 0 [0035.676] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.crypt")) returned 0x20 [0035.676] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 0x5c9000 [0035.676] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 0 [0035.676] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.676] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk")) returned 1 [0035.677] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk")) returned 0xffffffff [0035.677] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 1 [0035.677] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk")) returned 0x20 [0035.678] VirtualAlloc (lpAddress=0x3328000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3328000 [0035.678] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.678] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.679] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x50e, lpOverlapped=0x0) returned 1 [0035.680] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x50e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x50e, lpOverlapped=0x0) returned 1 [0035.681] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.681] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.681] CloseHandle (hObject=0xfc) returned 1 [0035.681] CloseHandle (hObject=0x108) returned 1 [0035.681] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.crypt")) returned 0 [0035.682] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.crypt")) returned 0x20 [0035.682] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 0x5c9000 [0035.682] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 0 [0035.682] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.682] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk")) returned 1 [0035.683] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk")) returned 0xffffffff [0035.683] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 1 [0035.683] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk")) returned 0x20 [0035.683] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.683] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.684] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4f6, lpOverlapped=0x0) returned 1 [0035.685] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4f6, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4f6, lpOverlapped=0x0) returned 1 [0035.687] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.687] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.687] CloseHandle (hObject=0x108) returned 1 [0035.687] CloseHandle (hObject=0xfc) returned 1 [0035.687] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk.crypt")) returned 0 [0035.687] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk.crypt")) returned 0x20 [0035.687] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 0x5c9000 [0035.687] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 0 [0035.687] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.688] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk")) returned 1 [0035.689] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk")) returned 0xffffffff [0035.689] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0035.689] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 0x26 [0035.689] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.689] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.690] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x7a6, lpOverlapped=0x0) returned 1 [0035.690] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x7a6, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x7a6, lpOverlapped=0x0) returned 1 [0035.691] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.691] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.691] CloseHandle (hObject=0xfc) returned 1 [0035.691] CloseHandle (hObject=0x108) returned 1 [0035.692] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypt")) returned 0 [0035.692] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypt")) returned 0x20 [0035.692] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0035.692] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0035.692] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.692] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 1 [0035.693] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 0xffffffff [0035.693] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 1 [0035.693] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk")) returned 0x20 [0035.694] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.694] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.695] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x512, lpOverlapped=0x0) returned 1 [0035.696] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x512, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x512, lpOverlapped=0x0) returned 1 [0035.697] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.697] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.697] CloseHandle (hObject=0x108) returned 1 [0035.697] CloseHandle (hObject=0xfc) returned 1 [0035.697] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.crypt")) returned 0 [0035.698] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.crypt")) returned 0x20 [0035.698] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 0x5c9000 [0035.698] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 0 [0035.698] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.698] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk")) returned 1 [0035.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk")) returned 0xffffffff [0035.699] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 1 [0035.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk")) returned 0x20 [0035.700] VirtualAlloc (lpAddress=0x332c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x332c000 [0035.700] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.700] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.701] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4fa, lpOverlapped=0x0) returned 1 [0035.703] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4fa, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4fa, lpOverlapped=0x0) returned 1 [0035.704] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.704] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.704] CloseHandle (hObject=0xfc) returned 1 [0035.704] CloseHandle (hObject=0x108) returned 1 [0035.704] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.crypt")) returned 0 [0035.704] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.crypt")) returned 0x20 [0035.704] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 0x5c9000 [0035.704] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 0 [0035.704] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.705] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk")) returned 1 [0035.705] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk")) returned 0xffffffff [0035.705] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 1 [0035.705] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk")) returned 0x20 [0035.706] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.706] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.707] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4f4, lpOverlapped=0x0) returned 1 [0035.708] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4f4, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4f4, lpOverlapped=0x0) returned 1 [0035.709] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.709] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.709] CloseHandle (hObject=0x108) returned 1 [0035.709] CloseHandle (hObject=0xfc) returned 1 [0035.709] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.crypt")) returned 0 [0035.709] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.crypt")) returned 0x20 [0035.709] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 0x5c9000 [0035.709] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 0 [0035.709] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.710] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk")) returned 1 [0035.710] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk")) returned 0xffffffff [0035.710] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 1 [0035.710] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk")) returned 0x20 [0035.711] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.711] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.711] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4d0, lpOverlapped=0x0) returned 1 [0035.714] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4d0, lpOverlapped=0x0) returned 1 [0035.714] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.714] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.714] CloseHandle (hObject=0xfc) returned 1 [0035.715] CloseHandle (hObject=0x108) returned 1 [0035.715] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.crypt")) returned 0 [0035.715] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.crypt")) returned 0x20 [0035.715] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 0x5c9000 [0035.715] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 0 [0035.715] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.715] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk")) returned 1 [0035.716] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk")) returned 0xffffffff [0035.716] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d09e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x806d09e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8071cca0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 1 [0035.716] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk")) returned 0x20 [0035.716] VirtualAlloc (lpAddress=0x3330000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3330000 [0035.717] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.717] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.718] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4ee, lpOverlapped=0x0) returned 1 [0035.719] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4ee, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4ee, lpOverlapped=0x0) returned 1 [0035.720] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.720] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.720] CloseHandle (hObject=0x108) returned 1 [0035.720] CloseHandle (hObject=0xfc) returned 1 [0035.720] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.crypt")) returned 0 [0035.721] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.crypt")) returned 0x20 [0035.721] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d09e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x806d09e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8071cca0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 0x5c9000 [0035.721] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d09e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x806d09e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8071cca0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 0 [0035.721] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.721] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk")) returned 1 [0035.722] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk")) returned 0xffffffff [0035.722] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c3cfe0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security Configuration Management.lnk", cAlternateFileName="SECURI~1.LNK")) returned 1 [0035.722] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk")) returned 0x20 [0035.722] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.722] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.723] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4e0, lpOverlapped=0x0) returned 1 [0035.725] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4e0, lpOverlapped=0x0) returned 1 [0035.728] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.728] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.728] CloseHandle (hObject=0xfc) returned 1 [0035.728] CloseHandle (hObject=0x108) returned 1 [0035.728] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.crypt")) returned 0 [0035.729] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.crypt")) returned 0x20 [0035.729] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c3cfe0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Security Configuration Management.lnk", cAlternateFileName="SECURI~1.LNK")) returned 0x5c9000 [0035.729] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c3cfe0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Security Configuration Management.lnk", cAlternateFileName="SECURI~1.LNK")) returned 0 [0035.729] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.729] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk")) returned 1 [0035.730] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk")) returned 0xffffffff [0035.730] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="services.lnk", cAlternateFileName="")) returned 1 [0035.730] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk")) returned 0x20 [0035.731] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.731] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.737] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x508, lpOverlapped=0x0) returned 1 [0035.739] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x508, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x508, lpOverlapped=0x0) returned 1 [0035.740] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.740] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.740] CloseHandle (hObject=0x108) returned 1 [0035.740] CloseHandle (hObject=0xfc) returned 1 [0035.740] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.crypt")) returned 0 [0035.740] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.crypt")) returned 0x20 [0035.740] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="services.lnk", cAlternateFileName="")) returned 0x5c9000 [0035.740] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="services.lnk", cAlternateFileName="")) returned 0 [0035.740] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.740] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk")) returned 1 [0035.741] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk")) returned 0xffffffff [0035.741] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Configuration.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0035.741] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk")) returned 0x20 [0035.742] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.742] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.744] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4de, lpOverlapped=0x0) returned 1 [0035.745] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4de, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4de, lpOverlapped=0x0) returned 1 [0035.746] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.746] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.746] CloseHandle (hObject=0xfc) returned 1 [0035.746] CloseHandle (hObject=0x108) returned 1 [0035.746] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.crypt")) returned 0 [0035.746] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.crypt")) returned 0x20 [0035.746] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="System Configuration.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 0x5c9000 [0035.747] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="System Configuration.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 0 [0035.747] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.747] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk")) returned 1 [0035.747] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk")) returned 0xffffffff [0035.748] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0035.748] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk")) returned 0x20 [0035.748] VirtualAlloc (lpAddress=0x3334000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3334000 [0035.749] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.749] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.749] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4ee, lpOverlapped=0x0) returned 1 [0035.751] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4ee, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4ee, lpOverlapped=0x0) returned 1 [0035.752] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.752] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.752] CloseHandle (hObject=0x108) returned 1 [0035.752] CloseHandle (hObject=0xfc) returned 1 [0035.752] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.crypt")) returned 0 [0035.752] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.crypt")) returned 0x20 [0035.752] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 0x5c9000 [0035.752] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 0 [0035.752] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.752] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk")) returned 1 [0035.753] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk")) returned 0xffffffff [0035.753] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0035.753] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk")) returned 0x20 [0035.754] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.754] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.754] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4fa, lpOverlapped=0x0) returned 1 [0035.756] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4fa, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4fa, lpOverlapped=0x0) returned 1 [0035.757] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.757] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.757] CloseHandle (hObject=0xfc) returned 1 [0035.757] CloseHandle (hObject=0x108) returned 1 [0035.757] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.crypt")) returned 0 [0035.757] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.crypt")) returned 0x20 [0035.757] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x5c9000 [0035.758] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0035.758] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.758] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk")) returned 1 [0035.758] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk")) returned 0xffffffff [0035.759] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0035.759] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk")) returned 0x20 [0035.760] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.760] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.760] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xab5, lpOverlapped=0x0) returned 1 [0035.762] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xab5, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xab5, lpOverlapped=0x0) returned 1 [0035.762] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.762] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.763] CloseHandle (hObject=0x108) returned 1 [0035.763] CloseHandle (hObject=0xfc) returned 1 [0035.763] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk.crypt")) returned 0 [0035.763] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk.crypt")) returned 0x20 [0035.763] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x5c9000 [0035.763] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0035.763] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.763] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk")) returned 1 [0035.764] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk")) returned 0xffffffff [0035.764] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0035.764] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.764] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c01860, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0x68537265, dwReserved1=0x206c6c65, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0035.765] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk")) returned 0x20 [0035.765] VirtualAlloc (lpAddress=0x3338000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3338000 [0035.765] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0035.765] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.766] ReadFile (in: hFile=0x114, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x989, lpOverlapped=0x0) returned 1 [0035.925] WriteFile (in: hFile=0xfc, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x989, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x989, lpOverlapped=0x0) returned 1 [0035.926] ReadFile (in: hFile=0x114, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.926] WriteFile (in: hFile=0xfc, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.926] CloseHandle (hObject=0x114) returned 1 [0035.926] CloseHandle (hObject=0xfc) returned 1 [0035.926] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk.crypt")) returned 0 [0035.927] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk.crypt")) returned 0x20 [0035.927] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c01860, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 0x5c8fc0 [0035.927] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c01860, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 0 [0035.927] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.927] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk")) returned 1 [0035.928] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk")) returned 0xffffffff [0035.928] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0035.928] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 0x26 [0035.928] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.929] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0035.929] ReadFile (in: hFile=0xfc, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x46a, lpOverlapped=0x0) returned 1 [0035.930] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x46a, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x46a, lpOverlapped=0x0) returned 1 [0035.931] ReadFile (in: hFile=0xfc, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.931] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0035.931] CloseHandle (hObject=0xfc) returned 1 [0035.931] CloseHandle (hObject=0x114) returned 1 [0035.931] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypt")) returned 0 [0035.931] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypt")) returned 0x20 [0035.931] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8fc0 [0035.932] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0035.932] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0035.932] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 1 [0035.933] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 0xffffffff [0035.933] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="Games", cAlternateFileName="")) returned 1 [0035.933] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0035.933] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.933] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x88, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0035.933] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini")) returned 0x26 [0035.933] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0035.933] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.934] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x208, lpOverlapped=0x0) returned 1 [0035.934] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x208, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x208, lpOverlapped=0x0) returned 1 [0035.936] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.936] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0035.936] CloseHandle (hObject=0xfc) returned 1 [0035.936] CloseHandle (hObject=0x108) returned 1 [0035.936] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini.crypt")) returned 0 [0035.936] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini.crypt")) returned 0x20 [0035.936] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0035.937] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0035.937] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0035.937] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini")) returned 1 [0035.937] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini")) returned 0xffffffff [0035.938] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 1 [0035.938] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk")) returned 0x20 [0035.938] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0035.938] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.007] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x102, lpOverlapped=0x0) returned 1 [0036.008] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x102, lpOverlapped=0x0) returned 1 [0036.009] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.009] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.009] CloseHandle (hObject=0x108) returned 1 [0036.009] CloseHandle (hObject=0xfc) returned 1 [0036.009] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk.crypt")) returned 0 [0036.010] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk.crypt")) returned 0x20 [0036.010] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 0x5c9000 [0036.010] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 0 [0036.010] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.010] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk")) returned 1 [0036.011] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk")) returned 0xffffffff [0036.011] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 0 [0036.011] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.011] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x6e6c2e72, dwReserved1=0x18ee6b, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0036.011] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk")) returned 0x20 [0036.011] VirtualAlloc (lpAddress=0x333c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x333c000 [0036.012] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.012] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.013] ReadFile (in: hFile=0x114, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x8dd, lpOverlapped=0x0) returned 1 [0036.017] WriteFile (in: hFile=0xfc, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x8dd, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x8dd, lpOverlapped=0x0) returned 1 [0036.018] ReadFile (in: hFile=0x114, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.018] WriteFile (in: hFile=0xfc, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.018] CloseHandle (hObject=0x114) returned 1 [0036.018] CloseHandle (hObject=0xfc) returned 1 [0036.018] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.crypt")) returned 0 [0036.019] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.crypt")) returned 0x20 [0036.019] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0x5c8fc0 [0036.019] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0 [0036.019] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.019] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk")) returned 1 [0036.020] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk")) returned 0xffffffff [0036.020] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="Java", cAlternateFileName="")) returned 1 [0036.020] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x94, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.021] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x94, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.021] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x94, dwReserved1=0x0, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 1 [0036.021] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk")) returned 0x20 [0036.022] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.022] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.022] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x7cf, lpOverlapped=0x0) returned 1 [0036.024] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x7cf, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x7cf, lpOverlapped=0x0) returned 1 [0036.025] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.025] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.025] CloseHandle (hObject=0x114) returned 1 [0036.025] CloseHandle (hObject=0x108) returned 1 [0036.025] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.crypt")) returned 0 [0036.025] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.crypt")) returned 0x20 [0036.025] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 0x5c9000 [0036.025] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 0 [0036.025] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.025] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk")) returned 1 [0036.026] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk")) returned 0xffffffff [0036.026] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 1 [0036.026] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk")) returned 0x20 [0036.028] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.028] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.028] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x7e1, lpOverlapped=0x0) returned 1 [0036.030] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x7e1, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x7e1, lpOverlapped=0x0) returned 1 [0036.031] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.031] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.031] CloseHandle (hObject=0x108) returned 1 [0036.031] CloseHandle (hObject=0x114) returned 1 [0036.031] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.crypt")) returned 0 [0036.031] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.crypt")) returned 0x20 [0036.031] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 0x5c9000 [0036.031] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 0 [0036.031] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.031] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk")) returned 1 [0036.032] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk")) returned 0xffffffff [0036.032] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762a4380, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762a4380, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 1 [0036.032] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk")) returned 0x20 [0036.033] VirtualAlloc (lpAddress=0x3340000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3340000 [0036.034] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.034] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.034] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x7b7, lpOverlapped=0x0) returned 1 [0036.036] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x7b7, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x7b7, lpOverlapped=0x0) returned 1 [0036.037] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.037] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.037] CloseHandle (hObject=0x114) returned 1 [0036.037] CloseHandle (hObject=0x108) returned 1 [0036.037] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.crypt")) returned 0 [0036.038] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.crypt")) returned 0x20 [0036.038] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762a4380, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762a4380, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 0x5c9000 [0036.038] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762a4380, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762a4380, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 0 [0036.038] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.038] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk")) returned 1 [0036.039] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk")) returned 0xffffffff [0036.039] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7591eb80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7591eb80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Help.lnk", cAlternateFileName="GETHEL~1.LNK")) returned 1 [0036.039] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk")) returned 0x20 [0036.040] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.040] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.040] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4b6, lpOverlapped=0x0) returned 1 [0036.042] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4b6, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4b6, lpOverlapped=0x0) returned 1 [0036.043] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.043] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.043] CloseHandle (hObject=0x108) returned 1 [0036.043] CloseHandle (hObject=0x114) returned 1 [0036.043] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk.crypt")) returned 0 [0036.043] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk.crypt")) returned 0x20 [0036.043] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7591eb80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7591eb80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Get Help.lnk", cAlternateFileName="GETHEL~1.LNK")) returned 0x5c9000 [0036.043] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7591eb80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7591eb80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Get Help.lnk", cAlternateFileName="GETHEL~1.LNK")) returned 0 [0036.043] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.043] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk")) returned 1 [0036.044] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk")) returned 0xffffffff [0036.045] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 1 [0036.045] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk")) returned 0x20 [0036.047] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.047] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.047] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x45a, lpOverlapped=0x0) returned 1 [0036.049] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x45a, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x45a, lpOverlapped=0x0) returned 1 [0036.049] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.049] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.049] CloseHandle (hObject=0x114) returned 1 [0036.050] CloseHandle (hObject=0x108) returned 1 [0036.050] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk.crypt")) returned 0 [0036.050] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk.crypt")) returned 0x20 [0036.050] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 0x5c9000 [0036.050] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 0 [0036.050] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.050] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk")) returned 1 [0036.051] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk")) returned 0xffffffff [0036.051] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 0 [0036.051] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.051] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6f63, dwReserved1=0x6c6b6e6c, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0036.051] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.051] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.051] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 1 [0036.052] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk")) returned 0x20 [0036.052] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.052] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.053] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x518, lpOverlapped=0x0) returned 1 [0036.066] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x518, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x518, lpOverlapped=0x0) returned 1 [0036.067] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.067] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.067] CloseHandle (hObject=0x108) returned 1 [0036.067] CloseHandle (hObject=0x114) returned 1 [0036.067] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk.crypt")) returned 0 [0036.067] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk.crypt")) returned 0x20 [0036.067] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 0x5c9000 [0036.067] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 0 [0036.067] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.067] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk")) returned 1 [0036.068] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk")) returned 0xffffffff [0036.068] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 1 [0036.068] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk")) returned 0x20 [0036.069] VirtualAlloc (lpAddress=0x3344000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3344000 [0036.069] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.069] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.070] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4e0, lpOverlapped=0x0) returned 1 [0036.078] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4e0, lpOverlapped=0x0) returned 1 [0036.078] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.078] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.078] CloseHandle (hObject=0x114) returned 1 [0036.079] CloseHandle (hObject=0x108) returned 1 [0036.079] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk.crypt")) returned 0 [0036.079] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk.crypt")) returned 0x20 [0036.079] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 0x5c9000 [0036.079] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 0 [0036.079] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.079] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk")) returned 1 [0036.080] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk")) returned 0xffffffff [0036.080] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0036.080] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0x26 [0036.080] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.081] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.081] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x25e, lpOverlapped=0x0) returned 1 [0036.082] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x25e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x25e, lpOverlapped=0x0) returned 1 [0036.083] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.083] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.083] CloseHandle (hObject=0x108) returned 1 [0036.083] CloseHandle (hObject=0x114) returned 1 [0036.083] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypt")) returned 0 [0036.083] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypt")) returned 0x20 [0036.083] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.083] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0036.084] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.084] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 1 [0036.084] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0xffffffff [0036.085] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0036.085] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk")) returned 0x20 [0036.085] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.085] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.086] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4bc, lpOverlapped=0x0) returned 1 [0036.088] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4bc, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4bc, lpOverlapped=0x0) returned 1 [0036.089] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.089] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.089] CloseHandle (hObject=0x114) returned 1 [0036.089] CloseHandle (hObject=0x108) returned 1 [0036.089] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk.crypt")) returned 0 [0036.090] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk.crypt")) returned 0x20 [0036.090] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0x5c9000 [0036.090] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0 [0036.090] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.090] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk")) returned 1 [0036.091] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk")) returned 0xffffffff [0036.091] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0 [0036.091] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.091] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x6e617473, dwReserved1=0x6c2e6563, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 1 [0036.091] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk")) returned 0x20 [0036.092] VirtualAlloc (lpAddress=0x3348000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3348000 [0036.092] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.092] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.093] ReadFile (in: hFile=0xfc, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x541, lpOverlapped=0x0) returned 1 [0036.094] WriteFile (in: hFile=0x108, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x541, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x541, lpOverlapped=0x0) returned 1 [0036.095] ReadFile (in: hFile=0xfc, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.096] WriteFile (in: hFile=0x108, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.096] CloseHandle (hObject=0xfc) returned 1 [0036.096] CloseHandle (hObject=0x108) returned 1 [0036.096] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk.crypt")) returned 0 [0036.096] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk.crypt")) returned 0x20 [0036.096] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 0x5c8fc0 [0036.096] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 0 [0036.096] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.096] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk")) returned 1 [0036.097] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk")) returned 0xffffffff [0036.097] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0036.097] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x92, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.097] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x92, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.097] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780122b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x92, dwReserved1=0x0, cFileName="Microsoft Access 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0036.097] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk")) returned 0x20 [0036.098] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.098] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.099] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xb67, lpOverlapped=0x0) returned 1 [0036.100] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xb67, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xb67, lpOverlapped=0x0) returned 1 [0036.101] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.101] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.101] CloseHandle (hObject=0xfc) returned 1 [0036.101] CloseHandle (hObject=0x114) returned 1 [0036.101] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk.crypt")) returned 0 [0036.102] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk.crypt")) returned 0x20 [0036.102] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780122b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft Access 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0x5c9000 [0036.102] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780122b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft Access 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0 [0036.102] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.102] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk")) returned 1 [0036.103] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk")) returned 0xffffffff [0036.103] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Excel 2010.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1 [0036.103] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk")) returned 0x20 [0036.103] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.104] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.104] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xb87, lpOverlapped=0x0) returned 1 [0036.105] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xb87, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xb87, lpOverlapped=0x0) returned 1 [0036.106] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.106] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.106] CloseHandle (hObject=0x114) returned 1 [0036.106] CloseHandle (hObject=0xfc) returned 1 [0036.106] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk.crypt")) returned 0 [0036.107] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk.crypt")) returned 0x20 [0036.108] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb87, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Excel 2010.lnk", cAlternateFileName="MICROS~2.LNK")) returned 0x5c9000 [0036.108] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb87, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Excel 2010.lnk", cAlternateFileName="MICROS~2.LNK")) returned 0 [0036.108] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.108] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk")) returned 1 [0036.109] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk")) returned 0xffffffff [0036.109] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Designer 2010.lnk", cAlternateFileName="MIA4FF~1.LNK")) returned 1 [0036.109] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk")) returned 0x20 [0036.110] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.110] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.110] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xbe2, lpOverlapped=0x0) returned 1 [0036.112] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xbe2, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xbe2, lpOverlapped=0x0) returned 1 [0036.113] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.113] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.113] CloseHandle (hObject=0xfc) returned 1 [0036.113] CloseHandle (hObject=0x114) returned 1 [0036.113] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk.crypt")) returned 0 [0036.113] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk.crypt")) returned 0x20 [0036.113] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft InfoPath Designer 2010.lnk", cAlternateFileName="MIA4FF~1.LNK")) returned 0x5c9000 [0036.113] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft InfoPath Designer 2010.lnk", cAlternateFileName="MIA4FF~1.LNK")) returned 0 [0036.113] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.113] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk")) returned 1 [0036.114] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk")) returned 0xffffffff [0036.114] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Microsoft InfoPath Filler 2010.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1 [0036.114] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk")) returned 0x20 [0036.115] VirtualAlloc (lpAddress=0x334c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x334c000 [0036.115] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.115] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.116] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xbd2, lpOverlapped=0x0) returned 1 [0036.117] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xbd2, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xbd2, lpOverlapped=0x0) returned 1 [0036.118] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.118] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.118] CloseHandle (hObject=0x114) returned 1 [0036.118] CloseHandle (hObject=0xfc) returned 1 [0036.118] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk.crypt")) returned 0 [0036.119] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk.crypt")) returned 0x20 [0036.119] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft InfoPath Filler 2010.lnk", cAlternateFileName="MICROS~4.LNK")) returned 0x5c9000 [0036.119] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft InfoPath Filler 2010.lnk", cAlternateFileName="MICROS~4.LNK")) returned 0 [0036.119] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.119] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk")) returned 1 [0036.120] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk")) returned 0xffffffff [0036.120] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Microsoft Office 2010 Tools", cAlternateFileName="MICROS~1")) returned 1 [0036.120] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.121] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.121] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0xd8, dwReserved1=0x0, cFileName="Digital Certificate for VBA Projects.lnk", cAlternateFileName="DIGITA~1.LNK")) returned 1 [0036.121] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk")) returned 0x20 [0036.122] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.122] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.123] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xba1, lpOverlapped=0x0) returned 1 [0036.125] WriteFile (in: hFile=0xf4, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xba1, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xba1, lpOverlapped=0x0) returned 1 [0036.125] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.125] WriteFile (in: hFile=0xf4, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.125] CloseHandle (hObject=0x114) returned 1 [0036.126] CloseHandle (hObject=0xf4) returned 1 [0036.126] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk.crypt")) returned 0 [0036.126] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk.crypt")) returned 0x20 [0036.126] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Digital Certificate for VBA Projects.lnk", cAlternateFileName="DIGITA~1.LNK")) returned 0x5c9040 [0036.126] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Digital Certificate for VBA Projects.lnk", cAlternateFileName="DIGITA~1.LNK")) returned 0 [0036.126] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.126] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk")) returned 1 [0036.127] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk")) returned 0xffffffff [0036.127] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb65, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Microsoft Clip Organizer.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0036.127] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk")) returned 0x20 [0036.128] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.128] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.129] ReadFile (in: hFile=0xf4, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xb65, lpOverlapped=0x0) returned 1 [0036.130] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xb65, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xb65, lpOverlapped=0x0) returned 1 [0036.131] ReadFile (in: hFile=0xf4, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.131] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.131] CloseHandle (hObject=0xf4) returned 1 [0036.131] CloseHandle (hObject=0x114) returned 1 [0036.132] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk.crypt")) returned 0 [0036.132] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk.crypt")) returned 0x20 [0036.132] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb65, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Clip Organizer.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0x5c9040 [0036.132] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb65, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Clip Organizer.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0 [0036.132] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.132] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk")) returned 1 [0036.133] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk")) returned 0xffffffff [0036.133] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xabf, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Microsoft Office 2010 Language Preferences.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1 [0036.133] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk")) returned 0x20 [0036.134] VirtualAlloc (lpAddress=0x3350000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3350000 [0036.134] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.134] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.135] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xabf, lpOverlapped=0x0) returned 1 [0036.136] WriteFile (in: hFile=0xf4, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xabf, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xabf, lpOverlapped=0x0) returned 1 [0036.137] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.137] WriteFile (in: hFile=0xf4, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.137] CloseHandle (hObject=0x114) returned 1 [0036.137] CloseHandle (hObject=0xf4) returned 1 [0036.137] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk.crypt")) returned 0 [0036.138] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk.crypt")) returned 0x20 [0036.138] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xabf, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft Office 2010 Language Preferences.lnk", cAlternateFileName="MICROS~4.LNK")) returned 0x5c9040 [0036.138] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xabf, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft Office 2010 Language Preferences.lnk", cAlternateFileName="MICROS~4.LNK")) returned 0 [0036.138] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.138] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk")) returned 1 [0036.139] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk")) returned 0xffffffff [0036.139] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Microsoft Office 2010 Upload Center.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1 [0036.139] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk")) returned 0x20 [0036.139] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.140] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.140] ReadFile (in: hFile=0xf4, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xb15, lpOverlapped=0x0) returned 1 [0036.142] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xb15, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xb15, lpOverlapped=0x0) returned 1 [0036.143] ReadFile (in: hFile=0xf4, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.143] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.143] CloseHandle (hObject=0xf4) returned 1 [0036.143] CloseHandle (hObject=0x114) returned 1 [0036.143] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk.crypt")) returned 0 [0036.143] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk.crypt")) returned 0x20 [0036.143] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Office 2010 Upload Center.lnk", cAlternateFileName="MICROS~3.LNK")) returned 0x5c9040 [0036.143] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Office 2010 Upload Center.lnk", cAlternateFileName="MICROS~3.LNK")) returned 0 [0036.143] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.143] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk")) returned 1 [0036.144] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk")) returned 0xffffffff [0036.144] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb3b, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Microsoft Office Picture Manager.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1 [0036.145] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk")) returned 0x20 [0036.145] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.145] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.146] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xb3b, lpOverlapped=0x0) returned 1 [0036.147] WriteFile (in: hFile=0xf4, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xb3b, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xb3b, lpOverlapped=0x0) returned 1 [0036.148] ReadFile (in: hFile=0x114, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.148] WriteFile (in: hFile=0xf4, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.148] CloseHandle (hObject=0x114) returned 1 [0036.148] CloseHandle (hObject=0xf4) returned 1 [0036.148] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk.crypt")) returned 0 [0036.149] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk.crypt")) returned 0x20 [0036.149] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb3b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft Office Picture Manager.lnk", cAlternateFileName="MICROS~2.LNK")) returned 0x5c9040 [0036.149] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb3b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft Office Picture Manager.lnk", cAlternateFileName="MICROS~2.LNK")) returned 0 [0036.149] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.149] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk")) returned 1 [0036.150] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk")) returned 0xffffffff [0036.150] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 1 [0036.150] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk")) returned 0x20 [0036.150] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.150] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.151] ReadFile (in: hFile=0xf4, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xbb7, lpOverlapped=0x0) returned 1 [0036.153] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xbb7, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xbb7, lpOverlapped=0x0) returned 1 [0036.154] ReadFile (in: hFile=0xf4, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.154] WriteFile (in: hFile=0x114, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.154] CloseHandle (hObject=0xf4) returned 1 [0036.154] CloseHandle (hObject=0x114) returned 1 [0036.154] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk.crypt")) returned 0 [0036.155] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk.crypt")) returned 0x20 [0036.155] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 0x5c9040 [0036.155] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 0 [0036.155] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.155] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk")) returned 1 [0036.156] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk")) returned 0xffffffff [0036.156] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 0 [0036.156] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb3f, dwReserved0=0x656a6f72, dwReserved1=0x53207463, cFileName="Microsoft OneNote 2010.lnk", cAlternateFileName="MI807F~1.LNK")) returned 1 [0036.156] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk")) returned 0x20 [0036.156] VirtualAlloc (lpAddress=0x3354000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3354000 [0036.157] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.157] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.157] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xb3f, lpOverlapped=0x0) returned 1 [0036.159] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xb3f, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xb3f, lpOverlapped=0x0) returned 1 [0036.160] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.160] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.160] CloseHandle (hObject=0xfc) returned 1 [0036.160] CloseHandle (hObject=0x114) returned 1 [0036.160] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk.crypt")) returned 0 [0036.160] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk.crypt")) returned 0x20 [0036.160] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb3f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft OneNote 2010.lnk", cAlternateFileName="MI807F~1.LNK")) returned 0x5c9000 [0036.160] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb3f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft OneNote 2010.lnk", cAlternateFileName="MI807F~1.LNK")) returned 0 [0036.160] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.161] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk")) returned 1 [0036.161] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk")) returned 0xffffffff [0036.161] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd5, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Microsoft Outlook 2010.lnk", cAlternateFileName="MI4465~1.LNK")) returned 1 [0036.162] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk")) returned 0x20 [0036.162] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.162] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.163] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xbd5, lpOverlapped=0x0) returned 1 [0036.164] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xbd5, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xbd5, lpOverlapped=0x0) returned 1 [0036.165] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.165] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.165] CloseHandle (hObject=0x114) returned 1 [0036.165] CloseHandle (hObject=0xfc) returned 1 [0036.165] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk.crypt")) returned 0 [0036.166] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk.crypt")) returned 0x20 [0036.166] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd5, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Outlook 2010.lnk", cAlternateFileName="MI4465~1.LNK")) returned 0x5c9000 [0036.166] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd5, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Outlook 2010.lnk", cAlternateFileName="MI4465~1.LNK")) returned 0 [0036.166] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.166] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk")) returned 1 [0036.167] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk")) returned 0xffffffff [0036.167] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb79, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Microsoft PowerPoint 2010.lnk", cAlternateFileName="MIAF79~1.LNK")) returned 1 [0036.167] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk")) returned 0x20 [0036.167] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.167] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.168] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xb79, lpOverlapped=0x0) returned 1 [0036.169] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xb79, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xb79, lpOverlapped=0x0) returned 1 [0036.170] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.170] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.170] CloseHandle (hObject=0xfc) returned 1 [0036.170] CloseHandle (hObject=0x114) returned 1 [0036.170] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk.crypt")) returned 0 [0036.171] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk.crypt")) returned 0x20 [0036.171] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb79, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft PowerPoint 2010.lnk", cAlternateFileName="MIAF79~1.LNK")) returned 0x5c9000 [0036.171] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb79, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft PowerPoint 2010.lnk", cAlternateFileName="MIAF79~1.LNK")) returned 0 [0036.171] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.171] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk")) returned 1 [0036.172] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk")) returned 0xffffffff [0036.172] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb77, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Microsoft Project 2010.lnk", cAlternateFileName="MI6860~1.LNK")) returned 1 [0036.172] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk")) returned 0x20 [0036.172] VirtualAlloc (lpAddress=0x3358000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3358000 [0036.173] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.173] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.173] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xb77, lpOverlapped=0x0) returned 1 [0036.175] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xb77, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xb77, lpOverlapped=0x0) returned 1 [0036.176] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.176] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.176] CloseHandle (hObject=0x114) returned 1 [0036.176] CloseHandle (hObject=0xfc) returned 1 [0036.176] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk.crypt")) returned 0 [0036.177] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk.crypt")) returned 0x20 [0036.177] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb77, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Project 2010.lnk", cAlternateFileName="MI6860~1.LNK")) returned 0x5c9000 [0036.177] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb77, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Project 2010.lnk", cAlternateFileName="MI6860~1.LNK")) returned 0 [0036.177] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.177] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk")) returned 1 [0036.178] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk")) returned 0xffffffff [0036.178] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Microsoft Publisher 2010.lnk", cAlternateFileName="MI260D~1.LNK")) returned 1 [0036.178] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk")) returned 0x20 [0036.178] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.179] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.179] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xbe1, lpOverlapped=0x0) returned 1 [0036.181] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xbe1, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xbe1, lpOverlapped=0x0) returned 1 [0036.181] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.182] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.182] CloseHandle (hObject=0xfc) returned 1 [0036.182] CloseHandle (hObject=0x114) returned 1 [0036.182] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk.crypt")) returned 0 [0036.182] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk.crypt")) returned 0x20 [0036.182] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft Publisher 2010.lnk", cAlternateFileName="MI260D~1.LNK")) returned 0x5c9000 [0036.182] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft Publisher 2010.lnk", cAlternateFileName="MI260D~1.LNK")) returned 0 [0036.182] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.182] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk")) returned 1 [0036.183] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk")) returned 0xffffffff [0036.183] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1 [0036.183] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk")) returned 0x20 [0036.184] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.184] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.185] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xbef, lpOverlapped=0x0) returned 1 [0036.195] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xbef, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xbef, lpOverlapped=0x0) returned 1 [0036.196] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.196] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.196] CloseHandle (hObject=0x114) returned 1 [0036.196] CloseHandle (hObject=0xfc) returned 1 [0036.196] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk.crypt")) returned 0 [0036.196] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk.crypt")) returned 0x20 [0036.196] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~3.LNK")) returned 0x5c9000 [0036.196] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~3.LNK")) returned 0 [0036.196] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.197] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk")) returned 1 [0036.197] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk")) returned 0xffffffff [0036.198] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8735be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x87381f60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0x5d1560, dwReserved1=0x18ec6c, cFileName="Microsoft Visio 2010.lnk", cAlternateFileName="MI7E65~1.LNK")) returned 1 [0036.198] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk")) returned 0x20 [0036.198] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.198] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.198] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xacf, lpOverlapped=0x0) returned 1 [0036.199] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xacf, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xacf, lpOverlapped=0x0) returned 1 [0036.200] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.200] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.200] CloseHandle (hObject=0xfc) returned 1 [0036.200] CloseHandle (hObject=0x114) returned 1 [0036.200] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk.crypt")) returned 0 [0036.201] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk.crypt")) returned 0x20 [0036.201] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8735be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x87381f60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft Visio 2010.lnk", cAlternateFileName="MI7E65~1.LNK")) returned 0x5c9000 [0036.201] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8735be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x87381f60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Microsoft Visio 2010.lnk", cAlternateFileName="MI7E65~1.LNK")) returned 0 [0036.201] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.201] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk")) returned 1 [0036.204] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk")) returned 0xffffffff [0036.204] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 1 [0036.204] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk")) returned 0x20 [0036.205] VirtualAlloc (lpAddress=0x335c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x335c000 [0036.205] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.205] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.206] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xbcd, lpOverlapped=0x0) returned 1 [0036.207] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xbcd, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xbcd, lpOverlapped=0x0) returned 1 [0036.208] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.208] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.208] CloseHandle (hObject=0x114) returned 1 [0036.208] CloseHandle (hObject=0xfc) returned 1 [0036.208] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk.crypt")) returned 0 [0036.208] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk.crypt")) returned 0x20 [0036.208] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 0x5c9000 [0036.208] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 0 [0036.209] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.209] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk")) returned 1 [0036.209] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk")) returned 0xffffffff [0036.210] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 0 [0036.210] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.210] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x2064726f, dwReserved1=0x30313032, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0036.210] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk")) returned 0x20 [0036.211] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.211] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.212] ReadFile (in: hFile=0x108, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x491, lpOverlapped=0x0) returned 1 [0036.213] WriteFile (in: hFile=0xfc, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x491, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x491, lpOverlapped=0x0) returned 1 [0036.214] ReadFile (in: hFile=0x108, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.214] WriteFile (in: hFile=0xfc, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.214] CloseHandle (hObject=0x108) returned 1 [0036.214] CloseHandle (hObject=0xfc) returned 1 [0036.214] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.crypt")) returned 0 [0036.214] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.crypt")) returned 0x20 [0036.214] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0x5c8fc0 [0036.215] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0036.215] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.215] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk")) returned 1 [0036.216] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk")) returned 0xffffffff [0036.216] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1 [0036.216] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.217] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.217] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x98, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0036.217] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk")) returned 0x20 [0036.217] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.218] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.218] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xbef, lpOverlapped=0x0) returned 1 [0036.219] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xbef, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xbef, lpOverlapped=0x0) returned 1 [0036.220] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.220] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.220] CloseHandle (hObject=0x108) returned 1 [0036.220] CloseHandle (hObject=0x114) returned 1 [0036.221] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk.crypt")) returned 0 [0036.221] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk.crypt")) returned 0x20 [0036.221] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0x5c9000 [0036.221] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0 [0036.221] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.221] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk")) returned 1 [0036.222] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk")) returned 0xffffffff [0036.222] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x98, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0 [0036.222] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.222] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x65726168, dwReserved1=0x6e696f50, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 1 [0036.222] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk")) returned 0x20 [0036.223] VirtualAlloc (lpAddress=0x3360000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3360000 [0036.223] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.223] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.224] ReadFile (in: hFile=0xfc, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x532, lpOverlapped=0x0) returned 1 [0036.225] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x532, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x532, lpOverlapped=0x0) returned 1 [0036.226] ReadFile (in: hFile=0xfc, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.226] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.226] CloseHandle (hObject=0xfc) returned 1 [0036.226] CloseHandle (hObject=0x114) returned 1 [0036.226] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk.crypt")) returned 0 [0036.226] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk.crypt")) returned 0x20 [0036.226] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 0x5c8fc0 [0036.227] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 0 [0036.227] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.227] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk")) returned 1 [0036.228] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk")) returned 0xffffffff [0036.228] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="Startup", cAlternateFileName="")) returned 1 [0036.228] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.228] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.228] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x88, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.228] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 0x26 [0036.228] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.228] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.229] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xae, lpOverlapped=0x0) returned 1 [0036.229] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xae, lpOverlapped=0x0) returned 1 [0036.231] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.231] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.231] CloseHandle (hObject=0xfc) returned 1 [0036.231] CloseHandle (hObject=0x108) returned 1 [0036.231] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypt")) returned 0 [0036.231] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypt")) returned 0x20 [0036.231] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.231] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.231] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.232] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 1 [0036.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 0xffffffff [0036.234] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x88, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.234] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.234] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0036.234] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.241] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.241] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 0 [0036.241] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.241] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0036.241] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk")) returned 0x20 [0036.241] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.242] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.242] ReadFile (in: hFile=0x114, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x548, lpOverlapped=0x0) returned 1 [0036.243] WriteFile (in: hFile=0x108, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x548, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x548, lpOverlapped=0x0) returned 1 [0036.244] ReadFile (in: hFile=0x114, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.244] WriteFile (in: hFile=0x108, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.244] CloseHandle (hObject=0x114) returned 1 [0036.244] CloseHandle (hObject=0x108) returned 1 [0036.244] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk.crypt")) returned 0 [0036.245] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk.crypt")) returned 0x20 [0036.245] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0x5c8fc0 [0036.245] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0 [0036.245] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.245] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk")) returned 1 [0036.246] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk")) returned 0xffffffff [0036.246] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x82491ce0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0036.246] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk")) returned 0x20 [0036.246] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.247] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.247] ReadFile (in: hFile=0x108, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x52e, lpOverlapped=0x0) returned 1 [0036.248] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x52e, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x52e, lpOverlapped=0x0) returned 1 [0036.249] ReadFile (in: hFile=0x108, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.249] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.249] CloseHandle (hObject=0x108) returned 1 [0036.249] CloseHandle (hObject=0x114) returned 1 [0036.250] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk.crypt")) returned 0 [0036.250] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk.crypt")) returned 0x20 [0036.250] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x82491ce0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0x5c8fc0 [0036.250] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x82491ce0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0 [0036.250] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.250] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk")) returned 1 [0036.251] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk")) returned 0xffffffff [0036.251] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0036.251] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk")) returned 0x20 [0036.251] VirtualAlloc (lpAddress=0x3364000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3364000 [0036.252] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.252] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.252] ReadFile (in: hFile=0x114, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x4ba, lpOverlapped=0x0) returned 1 [0036.253] WriteFile (in: hFile=0x108, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x4ba, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x4ba, lpOverlapped=0x0) returned 1 [0036.254] ReadFile (in: hFile=0x114, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.254] WriteFile (in: hFile=0x108, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.254] CloseHandle (hObject=0x114) returned 1 [0036.254] CloseHandle (hObject=0x108) returned 1 [0036.254] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk.crypt")) returned 0 [0036.254] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk.crypt")) returned 0x20 [0036.254] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x5c8fc0 [0036.254] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0036.255] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.255] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk")) returned 1 [0036.255] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk")) returned 0xffffffff [0036.256] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0036.256] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk")) returned 0x20 [0036.256] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.256] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.257] ReadFile (in: hFile=0x108, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x60b, lpOverlapped=0x0) returned 1 [0036.258] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x60b, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x60b, lpOverlapped=0x0) returned 1 [0036.259] ReadFile (in: hFile=0x108, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.259] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.259] CloseHandle (hObject=0x108) returned 1 [0036.259] CloseHandle (hObject=0x114) returned 1 [0036.259] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.crypt")) returned 0 [0036.259] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.crypt")) returned 0x20 [0036.259] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x5c8fc0 [0036.260] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0036.260] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.260] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk")) returned 1 [0036.261] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk")) returned 0xffffffff [0036.261] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 1 [0036.261] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk")) returned 0x20 [0036.261] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.261] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.261] ReadFile (in: hFile=0x114, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x4de, lpOverlapped=0x0) returned 1 [0036.262] WriteFile (in: hFile=0x108, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x4de, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x4de, lpOverlapped=0x0) returned 1 [0036.263] ReadFile (in: hFile=0x114, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.263] WriteFile (in: hFile=0x108, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.263] CloseHandle (hObject=0x114) returned 1 [0036.263] CloseHandle (hObject=0x108) returned 1 [0036.263] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk.crypt")) returned 0 [0036.264] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk.crypt")) returned 0x20 [0036.264] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0x5c8fc0 [0036.264] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0 [0036.264] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.264] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk")) returned 1 [0036.265] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk")) returned 0xffffffff [0036.265] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0 [0036.265] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.265] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x506b6e6c, dwReserved1=0x6579616c, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0036.265] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk")) returned 0x20 [0036.265] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0036.265] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.266] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x4f2, lpOverlapped=0x0) returned 1 [0036.267] WriteFile (in: hFile=0x108, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x4f2, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x4f2, lpOverlapped=0x0) returned 1 [0036.268] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0036.268] WriteFile (in: hFile=0x108, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0036.268] CloseHandle (hObject=0xf0) returned 1 [0036.268] CloseHandle (hObject=0x108) returned 1 [0036.268] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk.crypt")) returned 0 [0036.269] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk.crypt")) returned 0x20 [0036.269] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x5c8f80 [0036.269] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0036.269] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.269] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk")) returned 1 [0036.270] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk")) returned 0xffffffff [0036.270] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x506b6e6c, dwReserved1=0x6579616c, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0036.270] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.270] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e657461, dwReserved1=0x6e6b6e6c, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0036.270] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.270] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.270] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.270] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.270] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e657461, dwReserved1=0x6e6b6e6c, cFileName="WER", cAlternateFileName="")) returned 1 [0036.270] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.271] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.271] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0036.271] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.271] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.271] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.271] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.271] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1 [0036.271] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.272] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.272] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.272] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.272] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 0 [0036.272] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.272] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e657461, dwReserved1=0x6e6b6e6c, cFileName="WER", cAlternateFileName="")) returned 0 [0036.272] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.272] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x636e6569, dwReserved1=0x69442079, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0036.272] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656576, dwReserved1=0x6e6b6e6c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.274] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656576, dwReserved1=0x6e6b6e6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.274] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656576, dwReserved1=0x6e6b6e6c, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1 [0036.274] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.274] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.274] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1 [0036.274] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.275] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.275] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.275] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.275] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 1 [0036.275] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.275] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.276] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.276] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.276] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", cAlternateFileName="{D2B0B~1")) returned 1 [0036.276] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.276] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.276] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fd91f9, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fd91f9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x12c4d000, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0xb17190, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpasbase.vdm", cAlternateFileName="")) returned 1 [0036.276] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fff35a, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x6da22700, ftLastWriteTime.dwHighDateTime=0x1cb8783, nFileSizeHigh=0x0, nFileSizeLow=0x52d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpasdlta.vdm", cAlternateFileName="")) returned 1 [0036.276] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpengine.dll", cAlternateFileName="")) returned 1 [0036.276] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpengine.dll", cAlternateFileName="")) returned 0 [0036.276] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.276] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", cAlternateFileName="{D2B0B~1")) returned 0 [0036.276] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.276] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d444532, dwReserved1=0x33443434, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1 [0036.276] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.276] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.276] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.277] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.277] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d444532, dwReserved1=0x33443434, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1 [0036.277] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.277] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.277] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.277] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.277] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d444532, dwReserved1=0x33443434, cFileName="Scans", cAlternateFileName="")) returned 1 [0036.277] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.278] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.278] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0036.278] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.278] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.278] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc0a7e0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CacheManager", cAlternateFileName="CACHEM~1")) returned 1 [0036.297] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc0a7e0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.297] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc0a7e0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.298] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfc0a7e0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc30940, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x33b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpSfc.bin", cAlternateFileName="")) returned 1 [0036.298] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfc0a7e0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc30940, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x33b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpSfc.bin", cAlternateFileName="")) returned 0 [0036.298] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.298] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Results", cAlternateFileName="")) returned 1 [0036.298] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.298] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.298] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 1 [0036.298] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.298] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.298] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80be8ad0, ftCreationTime.dwHighDateTime=0x1d33740, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x81085570, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", cAlternateFileName="{1D1DB~1")) returned 1 [0036.298] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80be8ad0, ftCreationTime.dwHighDateTime=0x1d33740, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x81085570, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", cAlternateFileName="{1D1DB~1")) returned 0 [0036.298] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.298] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 0 [0036.298] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.298] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb9820270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Service", cAlternateFileName="")) returned 1 [0036.298] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb9820270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d463235, dwReserved1=0x32453734, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.308] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb9820270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d463235, dwReserved1=0x32453734, cFileName="..", cAlternateFileName="")) returned 1 [0036.308] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9820270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7de6c9b0, ftLastWriteTime.dwHighDateTime=0x1d3373d, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x2d463235, dwReserved1=0x32453734, cFileName="History.Log", cAlternateFileName="")) returned 1 [0036.308] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadeed740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xadeed740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x2d1f02a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x1a86, dwReserved0=0x2d463235, dwReserved1=0x32453734, cFileName="Unknown.Log", cAlternateFileName="")) returned 1 [0036.308] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadeed740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xadeed740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x2d1f02a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x1a86, dwReserved0=0x2d463235, dwReserved1=0x32453734, cFileName="Unknown.Log", cAlternateFileName="")) returned 0 [0036.308] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.308] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Store", cAlternateFileName="")) returned 1 [0036.308] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d463235, dwReserved1=0x32453734, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.308] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d463235, dwReserved1=0x32453734, cFileName="..", cAlternateFileName="")) returned 1 [0036.308] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d463235, dwReserved1=0x32453734, cFileName="..", cAlternateFileName="")) returned 0 [0036.308] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.308] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Store", cAlternateFileName="")) returned 0 [0036.308] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.308] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 0 [0036.308] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.308] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d444532, dwReserved1=0x33443434, cFileName="Support", cAlternateFileName="")) returned 1 [0036.308] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.309] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.309] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x798d48a0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x30ada, dwReserved0=0x72, dwReserved1=0x0, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 1 [0036.309] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x798d48a0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x30ada, dwReserved0=0x72, dwReserved1=0x0, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 0 [0036.309] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.309] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d444532, dwReserved1=0x33443434, cFileName="Support", cAlternateFileName="")) returned 0 [0036.309] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.309] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0036.309] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d393030, dwReserved1=0x30313232, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.309] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d393030, dwReserved1=0x30313232, cFileName="..", cAlternateFileName="")) returned 1 [0036.309] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d393030, dwReserved1=0x30313232, cFileName="MSFax", cAlternateFileName="")) returned 1 [0036.309] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.394] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.394] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="ActivityLog", cAlternateFileName="ACTIVI~1")) returned 1 [0036.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.394] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.394] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.394] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.394] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="Common Coverpages", cAlternateFileName="COMMON~1")) returned 1 [0036.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.394] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.394] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0036.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.395] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.395] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="confident.cov", cAlternateFileName="")) returned 1 [0036.395] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x0, dwReserved1=0x0, cFileName="fyi.cov", cAlternateFileName="")) returned 1 [0036.395] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="generic.cov", cAlternateFileName="")) returned 1 [0036.395] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 1 [0036.395] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x0, cFileName="urgent.cov", cAlternateFileName="")) returned 0 [0036.395] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.395] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0036.395] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.395] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="Inbox", cAlternateFileName="")) returned 1 [0036.395] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x766f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.396] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x766f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.396] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x766f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.396] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.396] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="Queue", cAlternateFileName="")) returned 1 [0036.396] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x766f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.396] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x766f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.396] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x766f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.396] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.396] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SentItems", cAlternateFileName="SENTIT~1")) returned 1 [0036.396] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x766f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.397] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x766f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.397] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x766f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.397] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.397] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 1 [0036.397] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x766f, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.397] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x766f, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.397] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x766f, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0036.397] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.398] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.398] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 1 [0036.398] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0 [0036.398] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.398] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x766f, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0036.398] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.398] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 0 [0036.398] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.398] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67617078, dwReserved1=0x30317365, cFileName="MSScan", cAlternateFileName="")) returned 1 [0036.398] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.398] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.398] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x72, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1 [0036.398] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0x20 [0036.399] VirtualAlloc (lpAddress=0x3368000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3368000 [0036.399] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.399] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0036.400] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.402] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.403] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.404] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.404] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.404] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.404] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.404] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.404] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.405] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.405] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.405] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.405] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.405] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.405] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.405] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.406] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.406] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.406] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.406] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.406] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.406] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.406] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.407] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.407] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.407] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.407] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.407] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.407] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.409] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.409] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.409] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.409] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.410] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.410] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.410] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.410] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.410] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.410] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.410] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.411] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.411] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.411] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.411] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.411] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.411] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.411] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.412] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.412] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.412] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.412] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.412] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.412] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.412] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.413] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.413] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.413] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.413] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.413] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.413] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.413] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.413] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.414] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.414] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.414] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.414] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.414] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.414] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.414] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.415] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.415] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.415] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.415] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.415] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.415] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.415] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.416] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.416] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.416] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.416] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.416] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.416] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.416] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.416] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.417] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.417] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.417] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.417] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.417] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.417] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.417] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.418] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.418] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.418] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.419] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.419] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.419] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.419] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.419] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.420] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.420] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.420] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.420] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.420] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.420] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.420] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.421] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.421] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.421] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.421] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.421] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.421] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.421] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.422] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.422] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.422] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.422] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.422] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.422] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.422] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.422] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.423] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.423] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.423] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.423] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.423] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.423] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.423] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.424] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.424] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.424] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.425] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.425] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.425] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.425] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.425] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.425] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.425] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.426] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.426] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.426] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.426] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.426] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.426] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.426] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.427] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.427] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.427] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.427] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.427] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.427] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.427] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.428] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.428] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.428] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.428] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.428] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.429] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.429] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.429] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.430] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.430] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.430] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.430] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.430] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.430] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.430] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.431] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.431] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.431] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.431] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.431] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.431] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.431] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.431] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.432] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.432] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.432] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.432] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.432] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.432] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.432] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.433] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.433] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.433] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.433] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.433] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.433] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.433] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.434] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.434] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.434] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.434] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.434] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.434] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.435] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.435] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.435] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.435] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.435] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.435] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.436] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.436] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.436] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.436] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.436] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.436] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.436] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.437] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.437] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.437] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.437] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.437] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.437] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.437] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.438] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.438] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.438] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.438] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.438] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.438] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.438] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.439] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.439] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.439] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.439] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.439] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.439] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.439] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.440] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.440] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.440] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.440] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.440] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.440] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.440] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.441] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.441] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.441] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.441] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.441] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.441] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.441] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.441] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.442] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.442] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.442] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.442] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.442] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.442] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.442] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.443] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x1000, lpOverlapped=0x0) returned 1 [0036.443] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x148, lpOverlapped=0x0) returned 1 [0036.443] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x148, lpOverlapped=0x0) returned 1 [0036.443] ReadFile (in: hFile=0x108, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0036.443] WriteFile (in: hFile=0xf0, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0036.443] CloseHandle (hObject=0x108) returned 1 [0036.443] CloseHandle (hObject=0xf0) returned 1 [0036.443] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg.crypt")) returned 0 [0036.443] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.crypt" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg.crypt")) returned 0x2020 [0036.443] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0x5c8f80 [0036.444] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0 [0036.444] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.444] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0 [0036.444] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0x20 [0036.444] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x72, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0 [0036.444] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.444] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67617078, dwReserved1=0x30317365, cFileName="MSScan", cAlternateFileName="")) returned 0 [0036.444] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.444] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0036.444] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.444] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="..", cAlternateFileName="")) returned 1 [0036.444] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="Profiles", cAlternateFileName="")) returned 1 [0036.444] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f13c, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.445] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f13c, cFileName="..", cAlternateFileName="")) returned 1 [0036.445] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f13c, cFileName="..", cAlternateFileName="")) returned 0 [0036.445] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.445] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="Profiles", cAlternateFileName="")) returned 0 [0036.445] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.445] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0036.445] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.445] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65646e65, dwReserved1=0x72757472, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0036.445] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0036.447] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="..", cAlternateFileName="")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x896b9210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x896b9210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="Hx.hxn", cAlternateFileName="")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.EXCEL.14.1033.hxn", cAlternateFileName="MSEXCE~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.EXCEL.DEV.14.1033.hxn", cAlternateFileName="MSEXCE~2.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.GRAPH.14.1033.hxn", cAlternateFileName="MSGRAP~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd822070, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.GROOVE.14.1033.hxn", cAlternateFileName="MSGROO~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11446a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.INFOPATH.14.1033.hxn", cAlternateFileName="MSINFO~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1146cbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.INFOPATHEDITOR.14.1033.hxn", cAlternateFileName="MSINFO~2.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.MSACCESS.14.1033.hxn", cAlternateFileName="MSMSAC~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.MSACCESS.DEV.14.1033.hxn", cAlternateFileName="MSMSAC~2.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.MSOUC.14.1033.hxn", cAlternateFileName="MSMSOU~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.MSPUB.14.1033.hxn", cAlternateFileName="MSMSPU~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.MSPUB.DEV.14.1033.hxn", cAlternateFileName="MSMSPU~2.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.MSTORE.14.1033.hxn", cAlternateFileName="MSMSTO~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.OIS.14.1033.hxn", cAlternateFileName="MSOIS1~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e3ad0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.ONENOTE.14.1033.hxn", cAlternateFileName="MSONEN~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2689510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.OUTLOOK.14.1033.hxn", cAlternateFileName="MSOUTL~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26af670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.OUTLOOK.DEV.14.1033.hxn", cAlternateFileName="MSOUTL~2.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.POWERPNT.14.1033.hxn", cAlternateFileName="MSPOWE~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.POWERPNT.DEV.14.1033.hxn", cAlternateFileName="MSPOWE~2.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.SETLANG.14.1033.hxn", cAlternateFileName="MSSETL~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5269fec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.VISIO.14.1033.hxn", cAlternateFileName="MSVISI~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.VISIO.DEV.14.1033.hxn", cAlternateFileName="MSVISI~3.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn", cAlternateFileName="MSVISI~4.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.VISIO_PRM.14.1033.hxn", cAlternateFileName="MSE1C9~1.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.VISIO_STD.14.1033.hxn", cAlternateFileName="MSVISI~2.HXN")) returned 1 [0036.448] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.WINPROJ.14.1033.hxn", cAlternateFileName="MSWINP~1.HXN")) returned 1 [0036.449] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.WINPROJ.DEV.14.1033.hxn", cAlternateFileName="MSWINP~2.HXN")) returned 1 [0036.449] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.WINWORD.14.1033.hxn", cAlternateFileName="MSWINW~1.HXN")) returned 1 [0036.449] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="MS.WINWORD.DEV.14.1033.hxn", cAlternateFileName="MSWINW~2.HXN")) returned 1 [0036.449] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="nslist.hxl", cAlternateFileName="")) returned 1 [0036.449] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="nslist.hxl", cAlternateFileName="")) returned 0 [0036.449] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.449] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e564544, dwReserved1=0x312e3431, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0036.450] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0036.450] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="..", cAlternateFileName="")) returned 1 [0036.450] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="logs", cAlternateFileName="")) returned 1 [0036.450] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.452] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="..", cAlternateFileName="")) returned 1 [0036.452] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 1 [0036.452] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 0 [0036.452] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.452] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="logs", cAlternateFileName="")) returned 0 [0036.452] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.452] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e564544, dwReserved1=0x312e3431, cFileName="Oracle", cAlternateFileName="")) returned 1 [0036.452] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76726573, dwReserved1=0x2d656369, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0036.452] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76726573, dwReserved1=0x2d656369, cFileName="..", cAlternateFileName="")) returned 1 [0036.452] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76726573, dwReserved1=0x2d656369, cFileName="..", cAlternateFileName="")) returned 0 [0036.452] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.452] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e564544, dwReserved1=0x312e3431, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0036.452] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76726573, dwReserved1=0x2d656369, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0036.454] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76726573, dwReserved1=0x2d656369, cFileName="..", cAlternateFileName="")) returned 1 [0036.455] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76726573, dwReserved1=0x2d656369, cFileName="42D5BEC7DDFBD49E76467529CBC2868987BF8460", cAlternateFileName="42D5BE~1")) returned 1 [0036.455] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.455] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="..", cAlternateFileName="")) returned 1 [0036.455] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="packages", cAlternateFileName="")) returned 1 [0036.455] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.455] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.455] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1 [0036.455] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.456] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.456] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0036.456] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.456] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.456] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0036.456] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0 [0036.456] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.456] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0036.456] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.456] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 0 [0036.456] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.456] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="packages", cAlternateFileName="")) returned 0 [0036.456] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.456] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76726573, dwReserved1=0x2d656369, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0036.456] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.457] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="..", cAlternateFileName="")) returned 1 [0036.457] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="packages", cAlternateFileName="")) returned 1 [0036.457] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.457] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.457] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1 [0036.457] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.458] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.458] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0036.458] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.458] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.459] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0036.459] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0 [0036.459] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.459] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0036.459] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.459] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 0 [0036.459] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.459] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="packages", cAlternateFileName="")) returned 0 [0036.459] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.459] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76726573, dwReserved1=0x2d656369, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0036.459] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.459] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="..", cAlternateFileName="")) returned 1 [0036.459] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="packages", cAlternateFileName="")) returned 1 [0036.459] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.460] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.460] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0036.460] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.460] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.460] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0036.460] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0036.460] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0036.460] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.461] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0036.461] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.462] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="packages", cAlternateFileName="")) returned 0 [0036.462] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.462] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76726573, dwReserved1=0x2d656369, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0036.462] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.462] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="..", cAlternateFileName="")) returned 1 [0036.462] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd314a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf08b3aa0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0036.462] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0036.462] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0036.462] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.462] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e36, dwReserved1=0x2d656365, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0036.462] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.463] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="..", cAlternateFileName="")) returned 1 [0036.463] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="packages", cAlternateFileName="")) returned 1 [0036.463] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.463] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="..", cAlternateFileName="")) returned 1 [0036.463] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0036.463] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.464] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.464] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87bcb00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0xa87bcb00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0xa87bcb00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0036.464] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0036.464] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0036.464] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.464] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0036.464] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.464] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="packages", cAlternateFileName="")) returned 0 [0036.464] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.464] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e36, dwReserved1=0x2d656365, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0036.464] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.465] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0036.465] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a127460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1c821ca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0036.465] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0036.465] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0036.465] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.465] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x2d656365, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0036.465] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.465] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0036.465] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 1 [0036.465] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.465] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="..", cAlternateFileName="")) returned 1 [0036.466] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0036.466] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.466] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.466] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15e8b00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd15e8b00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd15e8b00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0036.466] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0036.466] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0036.466] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.466] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0036.466] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.466] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 0 [0036.466] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.466] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x2d656365, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0036.466] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.467] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="..", cAlternateFileName="")) returned 1 [0036.467] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="packages", cAlternateFileName="")) returned 1 [0036.467] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.467] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="..", cAlternateFileName="")) returned 1 [0036.467] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0036.467] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.468] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.468] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0036.468] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0036.468] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0036.468] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.468] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0036.468] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.468] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="packages", cAlternateFileName="")) returned 0 [0036.468] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.468] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x2d656365, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0036.468] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.469] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0036.469] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 1 [0036.469] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.469] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="..", cAlternateFileName="")) returned 1 [0036.469] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0036.469] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.469] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.469] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0036.469] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0036.469] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0036.469] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.469] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0036.470] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.470] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 0 [0036.470] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.470] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x2d656365, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0036.470] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.470] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="..", cAlternateFileName="")) returned 1 [0036.470] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="packages", cAlternateFileName="")) returned 1 [0036.470] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.470] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="..", cAlternateFileName="")) returned 1 [0036.470] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0036.470] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.470] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.470] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9b1b00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7c9b1b00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7c9b1b00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0036.470] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0036.470] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0036.470] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.471] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0036.471] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.471] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="packages", cAlternateFileName="")) returned 0 [0036.471] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.471] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x2d656365, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0036.471] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.471] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0036.471] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 1 [0036.471] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.471] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="..", cAlternateFileName="")) returned 1 [0036.471] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0036.471] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.471] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.471] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b69ee00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7b69ee00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7b69ee00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0036.472] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0036.472] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0036.472] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.472] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0036.472] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.472] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 0 [0036.472] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.472] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x2d656365, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0036.472] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.473] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="..", cAlternateFileName="")) returned 1 [0036.473] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="packages", cAlternateFileName="")) returned 1 [0036.473] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.473] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="..", cAlternateFileName="")) returned 1 [0036.473] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0036.473] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.474] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.474] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aae6600, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x8aae6600, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x8aae6600, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0036.474] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0036.474] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0036.474] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.474] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0036.474] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.475] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="packages", cAlternateFileName="")) returned 0 [0036.475] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.475] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x2d656365, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0036.475] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.475] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0036.475] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 1 [0036.475] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.476] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="..", cAlternateFileName="")) returned 1 [0036.476] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0036.476] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.476] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.477] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x884c0c00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x884c0c00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x884c0c00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0036.477] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0036.477] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0036.477] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.477] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0036.477] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.477] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 0 [0036.477] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.477] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x2d656365, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0036.477] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.478] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="..", cAlternateFileName="")) returned 1 [0036.478] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfe3882c0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0036.478] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0036.478] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0036.478] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.478] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x2d656365, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0036.478] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.479] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="..", cAlternateFileName="")) returned 1 [0036.479] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="packages", cAlternateFileName="")) returned 1 [0036.479] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.480] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="..", cAlternateFileName="")) returned 1 [0036.480] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0036.480] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.480] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.480] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969a2800, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x969a2800, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x969a2800, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0036.480] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0036.480] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0036.480] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.480] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0036.480] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.480] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="packages", cAlternateFileName="")) returned 0 [0036.480] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.480] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x2d656365, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0036.480] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.481] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="..", cAlternateFileName="")) returned 1 [0036.481] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="packages", cAlternateFileName="")) returned 1 [0036.481] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.481] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="..", cAlternateFileName="")) returned 1 [0036.481] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0036.481] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.482] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.482] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7f300, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xdae7f300, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xdae7f300, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0036.482] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0036.482] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0036.482] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.482] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0036.482] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.482] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="packages", cAlternateFileName="")) returned 0 [0036.482] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.482] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x2d656365, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0036.482] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.482] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0036.482] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xe9f9cff0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0036.482] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0036.482] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0036.482] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.482] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3436, dwReserved1=0x2d656578, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0036.482] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.483] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0036.483] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad7040, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x105e7220, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0036.483] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0036.483] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0036.483] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.483] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e36, dwReserved1=0x2d656565, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0036.484] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.484] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0036.484] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93efac0, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6601040, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0036.484] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0036.484] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0036.484] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.484] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3638, dwReserved1=0x2d656578, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0036.485] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.485] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0036.485] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 1 [0036.485] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.485] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="..", cAlternateFileName="")) returned 1 [0036.485] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0036.485] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.485] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.485] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x532ebf00, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x532ebf00, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x532ebf00, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0036.485] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0036.485] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0036.485] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.486] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0036.486] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.486] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 0 [0036.486] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.486] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3638, dwReserved1=0x2d656578, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0036.486] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.486] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31373933, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0036.486] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3638, dwReserved1=0x2d656578, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0036.486] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31373933, cFileName="Sun", cAlternateFileName="")) returned 1 [0036.486] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3638, dwReserved1=0x2d656578, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.487] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3638, dwReserved1=0x2d656578, cFileName="..", cAlternateFileName="")) returned 1 [0036.487] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3638, dwReserved1=0x2d656578, cFileName="Java", cAlternateFileName="")) returned 1 [0036.487] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0036.487] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0036.487] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.488] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.488] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.488] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.488] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Templates\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3638, dwReserved1=0x2d656578, cFileName="Java", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0036.488] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0036.489] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31373933, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0036.489] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3638, dwReserved1=0x2d656578, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.489] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0036.490] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x3a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x203001e, ftLastAccessTime.dwHighDateTime=0x34d, ftLastWriteTime.dwLowDateTime=0x5a74b0, ftLastWriteTime.dwHighDateTime=0x5b8e50, nFileSizeHigh=0x5a7690, nFileSizeLow=0x77164885, dwReserved0=0x1000, dwReserved1=0x0, cFileName="", cAlternateFileName="\xc0\x8e\x5c")) returned 0xffffffff [0036.490] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x3a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x203001e, ftLastAccessTime.dwHighDateTime=0x34d, ftLastWriteTime.dwLowDateTime=0x5a74b0, ftLastWriteTime.dwHighDateTime=0x5b8e50, nFileSizeHigh=0x5a7690, nFileSizeLow=0x77164885, dwReserved0=0x1000, dwReserved1=0x0, cFileName="", cAlternateFileName="\xc0\x8e\x5c")) returned 0xffffffff [0036.490] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.491] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.492] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.492] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.494] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.495] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.496] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.496] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.496] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.496] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.496] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.497] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.498] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.498] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 0x2026 [0036.499] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.499] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.499] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0036.500] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0036.501] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.501] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.501] CloseHandle (hObject=0x114) returned 1 [0036.501] CloseHandle (hObject=0xfc) returned 1 [0036.501] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.crypt")) returned 0 [0036.501] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.crypt")) returned 0x2020 [0036.502] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.502] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.502] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.502] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 1 [0036.503] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 0xffffffff [0036.503] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0036.503] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0036.503] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.503] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1 [0036.503] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.503] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.503] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.503] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 0x2026 [0036.503] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.503] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.504] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0036.505] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0036.505] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.505] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.505] CloseHandle (hObject=0xfc) returned 1 [0036.505] CloseHandle (hObject=0x114) returned 1 [0036.506] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.crypt")) returned 0 [0036.506] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.crypt")) returned 0x2020 [0036.506] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.506] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.506] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.506] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 1 [0036.507] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 0xffffffff [0036.507] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0036.507] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0036.507] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.507] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1 [0036.507] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.507] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.507] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.507] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 0x2026 [0036.508] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.509] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.509] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0036.510] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0036.511] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.511] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.511] CloseHandle (hObject=0x114) returned 1 [0036.511] CloseHandle (hObject=0xfc) returned 1 [0036.511] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.crypt")) returned 0 [0036.511] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.crypt")) returned 0x2020 [0036.511] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.511] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.511] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.511] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 1 [0036.512] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 0xffffffff [0036.512] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0036.512] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0036.512] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.512] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.512] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 0x2026 [0036.514] VirtualAlloc (lpAddress=0x336c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x336c000 [0036.515] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.515] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.515] ReadFile (in: hFile=0x108, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x43, lpOverlapped=0x0) returned 1 [0036.516] WriteFile (in: hFile=0xfc, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x43, lpOverlapped=0x0) returned 1 [0036.517] ReadFile (in: hFile=0x108, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.517] WriteFile (in: hFile=0xfc, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.517] CloseHandle (hObject=0x108) returned 1 [0036.517] CloseHandle (hObject=0xfc) returned 1 [0036.517] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.crypt")) returned 0 [0036.517] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.crypt")) returned 0x2020 [0036.517] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8fc0 [0036.517] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.517] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.517] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 1 [0036.518] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 0xffffffff [0036.518] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa9d0d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0036.518] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1 [0036.518] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.518] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.518] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x80, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.518] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 0x2026 [0036.519] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.519] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.519] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0036.520] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0036.521] ReadFile (in: hFile=0x108, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.521] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.521] CloseHandle (hObject=0x108) returned 1 [0036.521] CloseHandle (hObject=0x114) returned 1 [0036.521] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.crypt")) returned 0 [0036.522] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.crypt")) returned 0x2020 [0036.522] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.522] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.522] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.522] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 1 [0036.523] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 0xffffffff [0036.523] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0036.523] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0036.523] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.523] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0 [0036.523] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.523] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96e13f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0036.523] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96e13f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.523] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96e13f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.523] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff12e0f2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.bak", cAlternateFileName="")) returned 1 [0036.523] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1 [0036.523] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 0x2020 [0036.524] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.524] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.525] ReadFile (in: hFile=0xfc, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0036.529] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0036.530] ReadFile (in: hFile=0xfc, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0036.530] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x1000, lpOverlapped=0x0) returned 1 [0036.530] ReadFile (in: hFile=0xfc, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0xfa9, lpOverlapped=0x0) returned 1 [0036.531] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0xfa9, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0xfa9, lpOverlapped=0x0) returned 1 [0036.531] ReadFile (in: hFile=0xfc, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.531] WriteFile (in: hFile=0x114, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.531] CloseHandle (hObject=0xfc) returned 1 [0036.531] CloseHandle (hObject=0x114) returned 1 [0036.531] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.crypt")) returned 0 [0036.531] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.crypt")) returned 0x2020 [0036.531] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="brndlog.txt", cAlternateFileName="")) returned 0x5c8fc0 [0036.531] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="brndlog.txt", cAlternateFileName="")) returned 0 [0036.531] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.531] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 1 [0036.532] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 0xffffffff [0036.532] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 0 [0036.532] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.532] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0036.532] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.534] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="..", cAlternateFileName="")) returned 1 [0036.535] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8679d27, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1 [0036.535] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1 [0036.535] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1 [0036.535] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.535] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.535] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0036.535] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.535] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.535] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 1 [0036.535] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0036.536] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0036.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1 [0036.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1 [0036.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1 [0036.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1 [0036.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1 [0036.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1 [0036.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1 [0036.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1 [0036.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1 [0036.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1 [0036.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1 [0036.537] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0036.537] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.538] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 0 [0036.538] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.538] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0036.538] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.538] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 0 [0036.538] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.538] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66d8860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62737473, dwReserved1=0x3237335f, cFileName="Windows", cAlternateFileName="")) returned 1 [0036.538] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66d8860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.539] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66d8860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="..", cAlternateFileName="")) returned 1 [0036.539] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="Burn", cAlternateFileName="")) returned 1 [0036.539] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.540] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.540] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1 [0036.540] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.540] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.540] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.540] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 0x2026 [0036.540] VirtualAlloc (lpAddress=0x3370000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3370000 [0036.540] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.541] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.541] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0xae, lpOverlapped=0x0) returned 1 [0036.542] WriteFile (in: hFile=0xf4, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0xae, lpOverlapped=0x0) returned 1 [0036.542] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.542] WriteFile (in: hFile=0xf4, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.543] CloseHandle (hObject=0x108) returned 1 [0036.543] CloseHandle (hObject=0xf4) returned 1 [0036.543] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.crypt")) returned 0 [0036.543] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.crypt")) returned 0x20 [0036.543] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9040 [0036.543] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.543] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.543] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 1 [0036.544] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 0xffffffff [0036.544] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.544] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.544] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 0 [0036.544] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.544] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="Caches", cAlternateFileName="")) returned 1 [0036.544] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.545] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.545] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.545] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.545] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18eed4, cFileName="Explorer", cAlternateFileName="")) returned 1 [0036.545] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.546] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.546] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4777f11, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x8c, dwReserved1=0x0, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1 [0036.546] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb8291b2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x8c, dwReserved1=0x0, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1 [0036.546] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x8c, dwReserved1=0x0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1 [0036.546] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x8c, dwReserved1=0x0, cFileName="thumbcache_256.db", cAlternateFileName="TH5A2B~1.DB")) returned 1 [0036.546] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x8c, dwReserved1=0x0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~4.DB")) returned 1 [0036.546] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x8c, dwReserved1=0x0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1 [0036.547] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x8c, dwReserved1=0x0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~2.DB")) returned 1 [0036.547] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x8c, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 1 [0036.547] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x8c, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 0 [0036.547] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.547] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0036.547] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.547] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.548] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.548] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.548] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="History", cAlternateFileName="")) returned 1 [0036.548] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.548] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.548] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x8c, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.548] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 0x2026 [0036.549] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.549] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.549] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x91, lpOverlapped=0x0) returned 1 [0036.550] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x91, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x91, lpOverlapped=0x0) returned 1 [0036.551] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.551] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.551] CloseHandle (hObject=0xfc) returned 1 [0036.551] CloseHandle (hObject=0xf4) returned 1 [0036.551] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.crypt")) returned 0 [0036.551] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.crypt")) returned 0x2020 [0036.551] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.551] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.551] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.551] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 1 [0036.552] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 0xffffffff [0036.552] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e4d86f4, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0036.552] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e4d86f4, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.553] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e4d86f4, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.553] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x88, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.553] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 0x2026 [0036.553] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.554] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.554] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x91, lpOverlapped=0x0) returned 1 [0036.555] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x91, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x91, lpOverlapped=0x0) returned 1 [0036.556] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.556] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.556] CloseHandle (hObject=0xfc) returned 1 [0036.556] CloseHandle (hObject=0x108) returned 1 [0036.556] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.crypt")) returned 0 [0036.556] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.crypt")) returned 0x2020 [0036.556] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9040 [0036.556] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.556] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.556] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 1 [0036.557] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 0xffffffff [0036.557] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0036.557] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0036.557] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.557] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Low", cAlternateFileName="")) returned 1 [0036.557] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.558] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.558] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.558] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.558] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Low", cAlternateFileName="")) returned 0 [0036.558] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.558] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0036.558] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.558] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.558] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 0 [0036.558] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.558] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7364c0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0036.558] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7364c0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.560] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7364c0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.560] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0036.560] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.561] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.561] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.561] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 0x2026 [0036.561] VirtualAlloc (lpAddress=0x3374000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3374000 [0036.562] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.562] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.562] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0036.563] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x43, lpOverlapped=0x0) returned 1 [0036.564] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.564] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.564] CloseHandle (hObject=0x108) returned 1 [0036.564] CloseHandle (hObject=0xfc) returned 1 [0036.564] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.crypt")) returned 0 [0036.564] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.crypt")) returned 0x2020 [0036.564] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9040 [0036.565] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.565] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.565] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 1 [0036.565] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 0xffffffff [0036.566] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e3cd240, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0036.566] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1 [0036.566] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0036.566] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.566] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xc2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.566] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 0x2026 [0036.566] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.566] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.567] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0036.567] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0036.568] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.568] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.568] CloseHandle (hObject=0x108) returned 1 [0036.568] CloseHandle (hObject=0x104) returned 1 [0036.568] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.crypt")) returned 0 [0036.569] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.crypt")) returned 0x2020 [0036.569] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9080 [0036.569] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.569] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.569] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 1 [0036.570] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 0xffffffff [0036.570] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xc2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.570] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.570] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1 [0036.570] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0036.570] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="..", cAlternateFileName="")) returned 1 [0036.570] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.570] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 0x2026 [0036.571] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.571] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.571] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0036.572] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0036.573] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.573] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.573] CloseHandle (hObject=0x104) returned 1 [0036.573] CloseHandle (hObject=0x108) returned 1 [0036.573] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.crypt")) returned 0 [0036.573] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.crypt")) returned 0x2020 [0036.573] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9080 [0036.573] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.573] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.573] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 1 [0036.574] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 0xffffffff [0036.574] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.574] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.574] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1 [0036.574] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0036.575] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="..", cAlternateFileName="")) returned 1 [0036.575] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.575] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 0x2026 [0036.575] VirtualAlloc (lpAddress=0x3378000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3378000 [0036.576] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.576] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.576] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0036.577] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0036.578] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.578] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.578] CloseHandle (hObject=0x108) returned 1 [0036.578] CloseHandle (hObject=0x104) returned 1 [0036.578] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.crypt")) returned 0 [0036.578] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.crypt")) returned 0x2020 [0036.578] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9080 [0036.579] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.579] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.579] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 1 [0036.579] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 0xffffffff [0036.580] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.580] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.580] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 1 [0036.580] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0036.580] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="..", cAlternateFileName="")) returned 1 [0036.580] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.580] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 0x2026 [0036.580] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.580] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.581] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0036.582] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x43, lpOverlapped=0x0) returned 1 [0036.583] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.583] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.583] CloseHandle (hObject=0x104) returned 1 [0036.583] CloseHandle (hObject=0x108) returned 1 [0036.583] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.crypt")) returned 0 [0036.583] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.crypt")) returned 0x2020 [0036.583] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9080 [0036.583] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.583] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.583] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 1 [0036.584] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 0xffffffff [0036.584] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.584] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.584] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 0 [0036.584] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.584] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.584] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 0x2026 [0036.585] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.585] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.585] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0036.586] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x43, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x43, lpOverlapped=0x0) returned 1 [0036.587] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.587] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.587] CloseHandle (hObject=0xf4) returned 1 [0036.587] CloseHandle (hObject=0xfc) returned 1 [0036.587] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.crypt")) returned 0 [0036.587] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.crypt")) returned 0x2020 [0036.587] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.587] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.588] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.588] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 1 [0036.588] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 0xffffffff [0036.588] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0036.588] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.589] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.589] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.589] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.589] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0036.589] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.589] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.589] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.589] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.589] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0036.589] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.589] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x579672e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0036.589] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x579672e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1 [0036.589] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65cdec0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65cdec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1 [0036.589] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65cdec0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65cdec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1 [0036.589] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6581c00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6581c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1 [0036.589] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1 [0036.589] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="WER", cAlternateFileName="")) returned 1 [0036.589] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.590] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.590] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1 [0036.590] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.590] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.590] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.590] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.590] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0036.590] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.590] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.590] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.590] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.591] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0 [0036.591] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.591] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="WER", cAlternateFileName="")) returned 0 [0036.591] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.591] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66307b74, dwReserved1=0x61376436, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1 [0036.591] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.592] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="..", cAlternateFileName="")) returned 1 [0036.592] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1 [0036.592] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1 [0036.592] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1 [0036.592] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="Backup", cAlternateFileName="")) returned 1 [0036.592] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.593] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.593] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="new", cAlternateFileName="")) returned 1 [0036.593] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.594] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.594] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x650f7e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0036.595] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e9680, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64e9680, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0036.595] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e9680, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64e9680, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0036.595] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e9680, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64e9680, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0036.595] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.595] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="new", cAlternateFileName="")) returned 0 [0036.595] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.595] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd7bc3a13, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0036.595] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd7bc3a13, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="edb.log", cAlternateFileName="")) returned 1 [0036.595] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0036.596] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0036.596] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0036.596] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="oeold.xml", cAlternateFileName="")) returned 1 [0036.596] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e6576, dwReserved1=0x5f626262, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0036.596] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.597] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 1 [0036.597] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0036.597] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0036.597] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 0x2020 [0036.597] VirtualAlloc (lpAddress=0x337c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x337c000 [0036.598] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.598] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.598] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x432, lpOverlapped=0x0) returned 1 [0036.599] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x432, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x432, lpOverlapped=0x0) returned 1 [0036.600] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.600] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.600] CloseHandle (hObject=0xfc) returned 1 [0036.600] CloseHandle (hObject=0xf4) returned 1 [0036.600] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.crypt")) returned 0 [0036.601] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.crypt")) returned 0x2020 [0036.601] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Bears.jpg", cAlternateFileName="")) returned 0x5c9000 [0036.601] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Bears.jpg", cAlternateFileName="")) returned 0 [0036.601] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.601] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 1 [0036.602] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 0xffffffff [0036.602] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0036.602] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 0x2026 [0036.602] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.602] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.602] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x285, lpOverlapped=0x0) returned 1 [0036.603] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x285, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x285, lpOverlapped=0x0) returned 1 [0036.604] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.604] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.604] CloseHandle (hObject=0xf4) returned 1 [0036.604] CloseHandle (hObject=0xfc) returned 1 [0036.604] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.crypt")) returned 0 [0036.605] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.crypt")) returned 0x2020 [0036.605] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.605] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0036.605] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.605] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 1 [0036.606] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 0xffffffff [0036.606] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x650f7e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0036.606] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0036.606] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 0x2020 [0036.607] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.607] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.607] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.609] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.610] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.610] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.610] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.610] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.611] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.611] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.611] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.611] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.611] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xd3f, lpOverlapped=0x0) returned 1 [0036.611] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xd3f, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xd3f, lpOverlapped=0x0) returned 1 [0036.611] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.611] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.612] CloseHandle (hObject=0xfc) returned 1 [0036.612] CloseHandle (hObject=0xf4) returned 1 [0036.612] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.crypt")) returned 0 [0036.612] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.crypt")) returned 0x2020 [0036.612] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Garden.jpg", cAlternateFileName="")) returned 0x5c9000 [0036.612] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Garden.jpg", cAlternateFileName="")) returned 0 [0036.612] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.612] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 1 [0036.613] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 0xffffffff [0036.613] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1 [0036.613] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1 [0036.613] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 0x2020 [0036.614] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.614] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.614] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.616] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.617] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x906, lpOverlapped=0x0) returned 1 [0036.617] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x906, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x906, lpOverlapped=0x0) returned 1 [0036.617] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.617] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.617] CloseHandle (hObject=0xf4) returned 1 [0036.618] CloseHandle (hObject=0xfc) returned 1 [0036.618] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.crypt")) returned 0 [0036.618] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.crypt")) returned 0x2020 [0036.618] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 0x5c9000 [0036.618] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 0 [0036.618] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.618] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 1 [0036.619] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 0xffffffff [0036.619] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1 [0036.619] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1 [0036.619] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 0x2020 [0036.619] VirtualAlloc (lpAddress=0x3380000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3380000 [0036.620] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.620] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.620] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.622] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.623] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x7e, lpOverlapped=0x0) returned 1 [0036.623] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x7e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x7e, lpOverlapped=0x0) returned 1 [0036.623] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.623] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.623] CloseHandle (hObject=0xfc) returned 1 [0036.623] CloseHandle (hObject=0xf4) returned 1 [0036.623] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.crypt")) returned 0 [0036.624] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.crypt")) returned 0x2020 [0036.624] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 0x5c9000 [0036.624] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 0 [0036.624] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.624] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 1 [0036.625] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 0xffffffff [0036.625] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1 [0036.625] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1 [0036.625] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 0x2020 [0036.625] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.625] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.625] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.627] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.628] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x8ed, lpOverlapped=0x0) returned 1 [0036.629] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x8ed, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x8ed, lpOverlapped=0x0) returned 1 [0036.629] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.629] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.629] CloseHandle (hObject=0xf4) returned 1 [0036.629] CloseHandle (hObject=0xfc) returned 1 [0036.629] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.crypt")) returned 0 [0036.629] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.crypt")) returned 0x2020 [0036.629] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 0x5c9000 [0036.629] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 0 [0036.629] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.629] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 1 [0036.630] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 0xffffffff [0036.630] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0036.630] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0036.630] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 0x2020 [0036.631] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.631] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.631] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.633] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.634] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x3fb, lpOverlapped=0x0) returned 1 [0036.634] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x3fb, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x3fb, lpOverlapped=0x0) returned 1 [0036.634] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.634] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.634] CloseHandle (hObject=0xfc) returned 1 [0036.634] CloseHandle (hObject=0xf4) returned 1 [0036.635] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.crypt")) returned 0 [0036.635] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.crypt")) returned 0x2020 [0036.635] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Peacock.jpg", cAlternateFileName="")) returned 0x5c9000 [0036.635] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Peacock.jpg", cAlternateFileName="")) returned 0 [0036.635] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.635] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 1 [0036.636] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 0xffffffff [0036.636] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0036.636] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0036.636] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 0x2020 [0036.636] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.636] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.641] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x780, lpOverlapped=0x0) returned 1 [0036.642] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x780, lpOverlapped=0x0) returned 1 [0036.643] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.643] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.643] CloseHandle (hObject=0xf4) returned 1 [0036.643] CloseHandle (hObject=0xfc) returned 1 [0036.643] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.crypt")) returned 0 [0036.643] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.crypt")) returned 0x2020 [0036.643] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Roses.jpg", cAlternateFileName="")) returned 0x5c9000 [0036.643] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Roses.jpg", cAlternateFileName="")) returned 0 [0036.643] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.643] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 1 [0036.644] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 0xffffffff [0036.644] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1 [0036.644] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1 [0036.644] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 0x2020 [0036.645] VirtualAlloc (lpAddress=0x3384000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3384000 [0036.645] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.646] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.646] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.648] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.648] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x27e, lpOverlapped=0x0) returned 1 [0036.649] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x27e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x27e, lpOverlapped=0x0) returned 1 [0036.649] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.649] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.649] CloseHandle (hObject=0xfc) returned 1 [0036.649] CloseHandle (hObject=0xf4) returned 1 [0036.649] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.crypt")) returned 0 [0036.649] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.crypt")) returned 0x2020 [0036.649] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 0x5c9000 [0036.650] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 0 [0036.650] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.650] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 1 [0036.650] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 0xffffffff [0036.651] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6477260, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1 [0036.651] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e9680, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64e9680, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0036.651] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 0x2020 [0036.651] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.652] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.652] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.659] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.660] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.660] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.660] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x949, lpOverlapped=0x0) returned 1 [0036.660] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x949, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x949, lpOverlapped=0x0) returned 1 [0036.661] ReadFile (in: hFile=0xf4, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.661] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.661] CloseHandle (hObject=0xf4) returned 1 [0036.661] CloseHandle (hObject=0xfc) returned 1 [0036.661] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.crypt")) returned 0 [0036.661] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.crypt")) returned 0x2020 [0036.661] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e9680, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64e9680, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 0x5c9000 [0036.661] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e9680, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64e9680, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 0 [0036.661] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.661] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 1 [0036.662] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 0xffffffff [0036.662] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0036.662] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6477260, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0036.662] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 0x2020 [0036.663] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.663] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.663] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.665] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.666] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xd51, lpOverlapped=0x0) returned 1 [0036.666] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xd51, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xd51, lpOverlapped=0x0) returned 1 [0036.666] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.666] WriteFile (in: hFile=0xf4, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.666] CloseHandle (hObject=0xfc) returned 1 [0036.666] CloseHandle (hObject=0xf4) returned 1 [0036.666] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.crypt")) returned 0 [0036.666] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.crypt")) returned 0x2020 [0036.666] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6477260, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Stars.jpg", cAlternateFileName="")) returned 0x5c9000 [0036.667] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6477260, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0036.667] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.667] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 1 [0036.668] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 0xffffffff [0036.668] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6477260, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0036.668] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.668] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd7b05332, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0036.668] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0036.668] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0036.668] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.668] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0036.668] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.668] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="..", cAlternateFileName="")) returned 1 [0036.668] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="12.0", cAlternateFileName="")) returned 1 [0036.668] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.668] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.668] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1 [0036.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1 [0036.669] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0 [0036.669] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.669] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="12.0", cAlternateFileName="")) returned 0 [0036.669] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.669] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0036.669] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.669] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="..", cAlternateFileName="")) returned 1 [0036.670] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0036.670] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.670] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.670] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 0 [0036.670] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.670] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="Settings.ini", cAlternateFileName="")) returned 1 [0036.670] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 0x2020 [0036.670] VirtualAlloc (lpAddress=0x3388000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3388000 [0036.670] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.671] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.671] ReadFile (in: hFile=0x114, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x54, lpOverlapped=0x0) returned 1 [0036.672] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x54, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x54, lpOverlapped=0x0) returned 1 [0036.673] ReadFile (in: hFile=0x114, lpBuffer=0x18cf28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18cf28*, lpNumberOfBytesRead=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.673] WriteFile (in: hFile=0xf4, lpBuffer=0x18df28*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cc74, lpOverlapped=0x0 | out: lpBuffer=0x18df28*, lpNumberOfBytesWritten=0x18cc74*=0x0, lpOverlapped=0x0) returned 1 [0036.673] CloseHandle (hObject=0x114) returned 1 [0036.673] CloseHandle (hObject=0xf4) returned 1 [0036.673] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.crypt")) returned 0 [0036.673] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.crypt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.crypt")) returned 0x2020 [0036.673] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Settings.ini", cAlternateFileName="")) returned 0x5c8fc0 [0036.673] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18edc4 | out: lpFindFileData=0x18edc4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0036.673] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.673] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 1 [0036.674] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 0xffffffff [0036.674] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x706a6d67, dwReserved1=0x5f6d7467, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0036.674] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.674] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0036.674] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.674] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x7265, cFileName="Temp", cAlternateFileName="")) returned 1 [0036.674] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.675] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 1 [0036.675] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x77398c9, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1 [0036.675] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 0x2020 [0036.675] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0036.675] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.crypt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.678] ReadFile (in: hFile=0xf0, lpBuffer=0x18d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18d190*, lpNumberOfBytesRead=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0036.678] WriteFile (in: hFile=0xf4, lpBuffer=0x18e190*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18cedc, lpOverlapped=0x0 | out: lpBuffer=0x18e190*, lpNumberOfBytesWritten=0x18cedc*=0x0, lpOverlapped=0x0) returned 1 [0036.678] CloseHandle (hObject=0xf0) returned 1 [0036.678] CloseHandle (hObject=0xf4) returned 1 [0036.678] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.crypt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt.crypt")) returned 0 [0036.678] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.crypt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt.crypt")) returned 0x2020 [0036.678] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x77398c9, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0x5c8f80 [0036.678] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f02c | out: lpFindFileData=0x18f02c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x77398c9, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0 [0036.678] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.678] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 1 [0036.679] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 0xffffffff [0036.679] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x77398c9, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0 [0036.679] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.679] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e656c69, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0036.679] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x77398c9, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="\xc0\x8e\x5c")) returned 0xffffffff [0036.679] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e656c69, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0036.679] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.679] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0036.679] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e656c69, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0036.680] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e656c69, cFileName="..", cAlternateFileName="")) returned 1 [0036.680] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e656c69, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0036.680] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.680] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.680] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0036.680] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.680] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.680] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content", cAlternateFileName="")) returned 1 [0036.680] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.681] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.681] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0036.681] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0036.681] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 0 [0036.681] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.681] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34313342, dwReserved1=0x35344532, cFileName="MetaData", cAlternateFileName="")) returned 1 [0036.681] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.681] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.681] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0036.681] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0036.681] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 0 [0036.681] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.681] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34313342, dwReserved1=0x35344532, cFileName="MetaData", cAlternateFileName="")) returned 0 [0036.682] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.682] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 0 [0036.682] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.682] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e656c69, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0036.682] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.682] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="")) returned 1 [0036.682] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68636143, dwReserved1=0x2e656c65, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0036.682] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68636143, dwReserved1=0x2e656c65, cFileName="..", cAlternateFileName="")) returned 1 [0036.682] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68636143, dwReserved1=0x2e656c65, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0036.682] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.683] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.683] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0036.683] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.683] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.683] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.683] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.683] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0036.683] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.683] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0036.683] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0036.685] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.685] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0036.685] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.686] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.686] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.686] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.686] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0036.686] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.686] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.686] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0036.686] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.686] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.686] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.686] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.686] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0 [0036.686] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.686] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0036.686] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.687] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.687] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0036.687] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.688] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.688] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de4960a, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e1692f0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.688] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 0x26 [0036.689] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.689] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.689] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x92, lpOverlapped=0x0) returned 1 [0036.690] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x92, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x92, lpOverlapped=0x0) returned 1 [0036.691] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.691] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.691] CloseHandle (hObject=0x114) returned 1 [0036.691] CloseHandle (hObject=0xfc) returned 1 [0036.691] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.crypt")) returned 0 [0036.691] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.crypt")) returned 0x20 [0036.691] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de4960a, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e1692f0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.691] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de4960a, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e1692f0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.691] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.691] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 1 [0036.692] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 0xffffffff [0036.692] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de234aa, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1 [0036.692] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 0x20 [0036.693] VirtualAlloc (lpAddress=0x338c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x338c000 [0036.693] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.693] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.693] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x122, lpOverlapped=0x0) returned 1 [0036.694] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x122, lpOverlapped=0x0) returned 1 [0036.695] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.695] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.695] CloseHandle (hObject=0xfc) returned 1 [0036.695] CloseHandle (hObject=0x114) returned 1 [0036.695] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.crypt")) returned 0 [0036.695] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.crypt")) returned 0x20 [0036.695] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de234aa, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 0x5c9000 [0036.696] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de234aa, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 0 [0036.696] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.696] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 1 [0036.696] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 0xffffffff [0036.697] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1 [0036.697] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.697] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.697] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6, dwReserved1=0x0, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0036.697] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0036.697] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName="..", cAlternateFileName="")) returned 1 [0036.697] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName="..", cAlternateFileName="")) returned 0 [0036.697] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.697] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0036.697] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0036.699] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName="..", cAlternateFileName="")) returned 1 [0036.699] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x6c002e, dwReserved1=0x6b006e, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.699] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 0x26 [0036.699] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.699] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.700] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0xd3, lpOverlapped=0x0) returned 1 [0036.701] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0xd3, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0xd3, lpOverlapped=0x0) returned 1 [0036.701] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.701] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.701] CloseHandle (hObject=0x108) returned 1 [0036.702] CloseHandle (hObject=0x104) returned 1 [0036.702] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.crypt")) returned 0 [0036.702] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.crypt")) returned 0x20 [0036.702] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9080 [0036.702] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.702] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.702] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 1 [0036.703] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 0xffffffff [0036.703] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0036.703] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 0x20 [0036.703] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.703] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.704] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x5a9, lpOverlapped=0x0) returned 1 [0036.705] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x5a9, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x5a9, lpOverlapped=0x0) returned 1 [0036.706] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.706] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.706] CloseHandle (hObject=0x104) returned 1 [0036.706] CloseHandle (hObject=0x108) returned 1 [0036.706] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.crypt")) returned 0 [0036.707] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.crypt")) returned 0x20 [0036.707] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x5c9080 [0036.707] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0036.707] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.707] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 1 [0036.708] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 0xffffffff [0036.708] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0036.708] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 0x20 [0036.708] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.708] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.708] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x4cc, lpOverlapped=0x0) returned 1 [0036.710] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x4cc, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x4cc, lpOverlapped=0x0) returned 1 [0036.710] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.711] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.711] CloseHandle (hObject=0x108) returned 1 [0036.711] CloseHandle (hObject=0x104) returned 1 [0036.711] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.crypt")) returned 0 [0036.711] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.crypt")) returned 0x20 [0036.711] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x5c9080 [0036.711] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0036.711] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.711] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 1 [0036.712] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 0xffffffff [0036.712] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0036.712] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 0x20 [0036.713] VirtualAlloc (lpAddress=0x3390000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3390000 [0036.713] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.713] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.714] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x60b, lpOverlapped=0x0) returned 1 [0036.715] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x60b, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x60b, lpOverlapped=0x0) returned 1 [0036.717] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.717] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.717] CloseHandle (hObject=0x104) returned 1 [0036.717] CloseHandle (hObject=0x108) returned 1 [0036.717] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.crypt")) returned 0 [0036.717] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.crypt")) returned 0x20 [0036.717] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x5c9080 [0036.717] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0036.717] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.717] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 1 [0036.718] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 0xffffffff [0036.718] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0036.718] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.718] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6, dwReserved1=0x0, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0036.719] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.719] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de6f76b, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0036.719] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 0x20 [0036.719] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.719] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.719] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x110, lpOverlapped=0x0) returned 1 [0036.720] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x110, lpOverlapped=0x0) returned 1 [0036.721] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.721] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.721] CloseHandle (hObject=0x114) returned 1 [0036.721] CloseHandle (hObject=0xfc) returned 1 [0036.721] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.crypt")) returned 0 [0036.722] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.crypt")) returned 0x20 [0036.722] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de6f76b, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x5c9000 [0036.722] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de6f76b, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0036.722] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.722] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 1 [0036.723] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 0xffffffff [0036.723] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de6f76b, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0036.723] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.723] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 0 [0036.723] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.723] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0036.723] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.723] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0036.723] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0036.723] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1 [0036.723] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.725] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.725] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1 [0036.725] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0036.725] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0036.725] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.725] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 0 [0036.725] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.725] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31363131, dwReserved1=0x34373533, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0036.725] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3939, dwReserved1=0x2d356635, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.726] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3939, dwReserved1=0x2d356635, cFileName="..", cAlternateFileName="")) returned 1 [0036.726] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3939, dwReserved1=0x2d356635, cFileName="My", cAlternateFileName="")) returned 1 [0036.726] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.726] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.726] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0036.726] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.727] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.727] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.727] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.727] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="CRLs", cAlternateFileName="")) returned 1 [0036.727] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.727] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.727] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.727] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.727] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="CTLs", cAlternateFileName="")) returned 1 [0036.727] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.727] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.727] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.728] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.728] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="CTLs", cAlternateFileName="")) returned 0 [0036.728] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.728] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3939, dwReserved1=0x2d356635, cFileName="My", cAlternateFileName="")) returned 0 [0036.728] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.728] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31363131, dwReserved1=0x34373533, cFileName="Windows", cAlternateFileName="")) returned 1 [0036.728] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3973, dwReserved1=0x2d356635, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0036.730] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3973, dwReserved1=0x2d356635, cFileName="..", cAlternateFileName="")) returned 1 [0036.730] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7f4ba2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3973, dwReserved1=0x2d356635, cFileName="Cookies", cAlternateFileName="")) returned 1 [0036.730] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7f4ba2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.730] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7f4ba2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.730] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0036.730] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="index.dat", cAlternateFileName="")) returned 0 [0036.730] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.730] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3973, dwReserved1=0x2d356635, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0036.730] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.731] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.731] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Low", cAlternateFileName="")) returned 1 [0036.731] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.731] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.731] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.731] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.731] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Low", cAlternateFileName="")) returned 0 [0036.731] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.731] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3973, dwReserved1=0x2d356635, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1 [0036.731] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.732] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.732] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe6c3ce0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3c000, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="index.dat", cAlternateFileName="")) returned 1 [0036.733] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Low", cAlternateFileName="")) returned 1 [0036.733] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.733] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.733] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.733] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.733] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Low", cAlternateFileName="")) returned 0 [0036.733] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.733] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3973, dwReserved1=0x2d356635, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0036.733] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.734] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.734] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.735] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 0x2026 [0036.735] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.736] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.736] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x112, lpOverlapped=0x0) returned 1 [0036.737] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x112, lpOverlapped=0x0) returned 1 [0036.738] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.738] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.738] CloseHandle (hObject=0xfc) returned 1 [0036.738] CloseHandle (hObject=0x114) returned 1 [0036.738] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.crypt")) returned 0 [0036.738] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.crypt")) returned 0x2020 [0036.738] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.738] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.738] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.738] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 1 [0036.739] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 0xffffffff [0036.739] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xe03, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1 [0036.739] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdd9, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1 [0036.739] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1 [0036.739] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1 [0036.739] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0036.739] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.739] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0036.739] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.740] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.740] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 0 [0036.740] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.740] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0036.740] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.740] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.740] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 0 [0036.740] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.740] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0036.740] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.740] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.740] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Low", cAlternateFileName="")) returned 1 [0036.740] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.741] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.741] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0036.741] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.741] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Low", cAlternateFileName="")) returned 0 [0036.741] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.741] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Recent", cAlternateFileName="")) returned 1 [0036.741] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.742] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.742] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x125b3d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0036.742] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x125b3d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.742] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x125b3d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.742] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x14bb620, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x90, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0036.742] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x14bb620, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x90, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 0 [0036.742] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.742] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36393162, dwReserved1=0x75612e32, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0036.742] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.744] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.744] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x90, dwReserved1=0x0, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0036.744] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc67cc5, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x3c12, dwReserved0=0x90, dwReserved1=0x0, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0036.744] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x90, dwReserved1=0x0, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0036.744] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x90, dwReserved1=0x0, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 0 [0036.744] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.744] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x65333638, dwReserved1=0x75632e33, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.744] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 0x26 [0036.745] VirtualAlloc (lpAddress=0x3394000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3394000 [0036.745] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.745] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.749] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1b0, lpOverlapped=0x0) returned 1 [0036.750] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1b0, lpOverlapped=0x0) returned 1 [0036.751] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.751] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.751] CloseHandle (hObject=0x114) returned 1 [0036.751] CloseHandle (hObject=0xfc) returned 1 [0036.751] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.crypt")) returned 0 [0036.751] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.crypt")) returned 0x20 [0036.751] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.751] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.751] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.751] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 1 [0036.752] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 0xffffffff [0036.752] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x65333638, dwReserved1=0x75632e33, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.752] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.752] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974616e, dwReserved1=0x6f736e6f, cFileName="SendTo", cAlternateFileName="")) returned 1 [0036.752] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.754] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.754] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeca9f1ef, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0036.754] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c45a701, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0036.754] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xec18bec6, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0036.754] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 0x2026 [0036.754] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.754] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.755] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x22e, lpOverlapped=0x0) returned 1 [0036.756] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x22e, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x22e, lpOverlapped=0x0) returned 1 [0036.757] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.757] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.757] CloseHandle (hObject=0xfc) returned 1 [0036.757] CloseHandle (hObject=0x114) returned 1 [0036.757] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.crypt")) returned 0 [0036.757] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.crypt")) returned 0x2020 [0036.757] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xec18bec6, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.757] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xec18bec6, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0036.757] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.757] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 1 [0036.758] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 0xffffffff [0036.758] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63dece0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1 [0036.758] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d802e42, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 1 [0036.758] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 0x2020 [0036.759] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.759] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.760] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x4d6, lpOverlapped=0x0) returned 1 [0036.761] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x4d6, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x4d6, lpOverlapped=0x0) returned 1 [0036.762] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.762] WriteFile (in: hFile=0xfc, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.762] CloseHandle (hObject=0x114) returned 1 [0036.762] CloseHandle (hObject=0xfc) returned 1 [0036.762] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.crypt")) returned 0 [0036.762] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.crypt")) returned 0x2020 [0036.763] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d802e42, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 0x5c9000 [0036.763] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d802e42, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 0 [0036.763] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.763] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 1 [0036.764] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 0xffffffff [0036.764] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0036.764] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0036.764] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.764] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0036.764] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.764] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="..", cAlternateFileName="")) returned 1 [0036.764] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x63dece0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.764] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini")) returned 0x26 [0036.764] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.764] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.765] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0xae, lpOverlapped=0x0) returned 1 [0036.766] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0xae, lpOverlapped=0x0) returned 1 [0036.766] ReadFile (in: hFile=0xfc, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.766] WriteFile (in: hFile=0x114, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.766] CloseHandle (hObject=0xfc) returned 1 [0036.767] CloseHandle (hObject=0x114) returned 1 [0036.767] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.crypt")) returned 0 [0036.767] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.crypt")) returned 0x20 [0036.767] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x63dece0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9000 [0036.767] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x63dece0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.767] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.767] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini")) returned 1 [0036.768] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini")) returned 0xffffffff [0036.768] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Programs", cAlternateFileName="")) returned 1 [0036.768] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x92, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0036.769] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x92, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.770] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x92, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0036.770] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0036.771] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.771] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0036.771] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0036.773] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.773] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0cd7f5, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0036.773] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 0x26 [0036.774] VirtualAlloc (lpAddress=0x3398000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3398000 [0036.774] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.774] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.775] ReadFile (in: hFile=0x104, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2c0, lpOverlapped=0x0) returned 1 [0036.776] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2c0, lpOverlapped=0x0) returned 1 [0036.776] ReadFile (in: hFile=0x104, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.776] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.777] CloseHandle (hObject=0x104) returned 1 [0036.777] CloseHandle (hObject=0x100) returned 1 [0036.777] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.crypt")) returned 0 [0036.777] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.crypt")) returned 0x20 [0036.777] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0cd7f5, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c90c0 [0036.777] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0cd7f5, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0036.777] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0036.777] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 1 [0036.778] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 0xffffffff [0036.778] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aadace0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 1 [0036.778] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 0x20 [0036.779] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.779] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.780] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x54e, lpOverlapped=0x0) returned 1 [0036.781] WriteFile (in: hFile=0x104, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x54e, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x54e, lpOverlapped=0x0) returned 1 [0036.782] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.782] WriteFile (in: hFile=0x104, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.782] CloseHandle (hObject=0x100) returned 1 [0036.782] CloseHandle (hObject=0x104) returned 1 [0036.782] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.crypt")) returned 0 [0036.782] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.crypt")) returned 0x20 [0036.782] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aadace0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 0x5c90c0 [0036.783] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aadace0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 0 [0036.783] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0036.783] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 1 [0036.783] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 0xffffffff [0036.784] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a911c5d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1 [0036.784] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 0x20 [0036.784] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.784] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.784] ReadFile (in: hFile=0x104, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x4ea, lpOverlapped=0x0) returned 1 [0036.786] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x4ea, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x4ea, lpOverlapped=0x0) returned 1 [0036.787] ReadFile (in: hFile=0x104, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.787] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.787] CloseHandle (hObject=0x104) returned 1 [0036.787] CloseHandle (hObject=0x100) returned 1 [0036.787] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.crypt")) returned 0 [0036.787] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.crypt")) returned 0x20 [0036.787] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a911c5d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Magnify.lnk", cAlternateFileName="")) returned 0x5c90c0 [0036.787] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a911c5d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Magnify.lnk", cAlternateFileName="")) returned 0 [0036.787] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0036.787] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 1 [0036.788] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 0xffffffff [0036.788] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b733f17, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1 [0036.788] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 0x20 [0036.789] VirtualAlloc (lpAddress=0x339c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x339c000 [0036.789] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.790] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.790] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x4ee, lpOverlapped=0x0) returned 1 [0036.792] WriteFile (in: hFile=0x104, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x4ee, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x4ee, lpOverlapped=0x0) returned 1 [0036.793] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.793] WriteFile (in: hFile=0x104, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.793] CloseHandle (hObject=0x100) returned 1 [0036.793] CloseHandle (hObject=0x104) returned 1 [0036.793] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.crypt")) returned 0 [0036.794] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.crypt")) returned 0x20 [0036.794] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b733f17, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Narrator.lnk", cAlternateFileName="")) returned 0x5c90c0 [0036.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b733f17, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Narrator.lnk", cAlternateFileName="")) returned 0 [0036.794] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0036.794] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 1 [0036.795] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 0xffffffff [0036.795] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9f649f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 1 [0036.795] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 0x20 [0036.795] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.795] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.796] ReadFile (in: hFile=0x104, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x4e2, lpOverlapped=0x0) returned 1 [0036.797] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x4e2, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x4e2, lpOverlapped=0x0) returned 1 [0036.798] ReadFile (in: hFile=0x104, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.798] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.798] CloseHandle (hObject=0x104) returned 1 [0036.798] CloseHandle (hObject=0x100) returned 1 [0036.798] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.crypt")) returned 0 [0036.798] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.crypt")) returned 0x20 [0036.798] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9f649f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0x5c90c0 [0036.798] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9f649f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0036.799] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0036.799] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 1 [0036.799] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 0xffffffff [0036.799] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9f649f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0036.800] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.800] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a53d8cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 1 [0036.800] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 0x20 [0036.800] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.800] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.800] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x500, lpOverlapped=0x0) returned 1 [0036.802] WriteFile (in: hFile=0x100, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x500, lpOverlapped=0x0) returned 1 [0036.802] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.802] WriteFile (in: hFile=0x100, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.803] CloseHandle (hObject=0x108) returned 1 [0036.803] CloseHandle (hObject=0x100) returned 1 [0036.803] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.crypt")) returned 0 [0036.803] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.crypt")) returned 0x20 [0036.803] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a53d8cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 0x5c9080 [0036.803] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a53d8cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 0 [0036.803] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.803] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 1 [0036.804] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 0xffffffff [0036.804] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0036.804] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0x26 [0036.805] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.805] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.805] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x2a6, lpOverlapped=0x0) returned 1 [0036.806] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x2a6, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x2a6, lpOverlapped=0x0) returned 1 [0036.807] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.807] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.807] CloseHandle (hObject=0x100) returned 1 [0036.807] CloseHandle (hObject=0x108) returned 1 [0036.807] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypt")) returned 0 [0036.808] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypt")) returned 0x20 [0036.808] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c9080 [0036.808] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0036.808] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.808] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 1 [0036.809] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0xffffffff [0036.809] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d655ee8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x5c8d98, dwReserved1=0x18e79c, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1 [0036.810] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 0x20 [0036.810] VirtualAlloc (lpAddress=0x33a0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33a0000 [0036.810] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.810] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.811] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x518, lpOverlapped=0x0) returned 1 [0036.812] WriteFile (in: hFile=0x100, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x518, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x518, lpOverlapped=0x0) returned 1 [0036.813] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.813] WriteFile (in: hFile=0x100, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.813] CloseHandle (hObject=0x108) returned 1 [0036.813] CloseHandle (hObject=0x100) returned 1 [0036.813] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.crypt")) returned 0 [0036.813] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.crypt")) returned 0x20 [0036.813] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d655ee8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0x5c9080 [0036.813] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d655ee8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0 [0036.814] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.814] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 1 [0036.814] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 0xffffffff [0036.814] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dcf29a8, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5c8d98, dwReserved1=0x18e79c, cFileName="Run.lnk", cAlternateFileName="")) returned 1 [0036.815] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 0x20 [0036.815] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.815] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.815] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x106, lpOverlapped=0x0) returned 1 [0036.816] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x106, lpOverlapped=0x0) returned 1 [0036.817] ReadFile (in: hFile=0x100, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.817] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.817] CloseHandle (hObject=0x100) returned 1 [0036.817] CloseHandle (hObject=0x108) returned 1 [0036.817] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.crypt")) returned 0 [0036.817] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.crypt")) returned 0x20 [0036.817] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dcf29a8, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Run.lnk", cAlternateFileName="")) returned 0x5c9080 [0036.818] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dcf29a8, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x63b8b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Run.lnk", cAlternateFileName="")) returned 0 [0036.818] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.818] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 1 [0036.818] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 0xffffffff [0036.819] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0036.819] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0036.820] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.820] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddd71ea, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0xb4, dwReserved1=0x0, cFileName="computer.lnk", cAlternateFileName="")) returned 1 [0036.820] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 0x20 [0036.820] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.820] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.821] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x106, lpOverlapped=0x0) returned 1 [0036.822] WriteFile (in: hFile=0x104, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x106, lpOverlapped=0x0) returned 1 [0036.823] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.823] WriteFile (in: hFile=0x104, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.823] CloseHandle (hObject=0x100) returned 1 [0036.823] CloseHandle (hObject=0x104) returned 1 [0036.823] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.crypt")) returned 0 [0036.823] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.crypt")) returned 0x20 [0036.823] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddd71ea, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="computer.lnk", cAlternateFileName="")) returned 0x5c90c0 [0036.823] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddd71ea, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="computer.lnk", cAlternateFileName="")) returned 0 [0036.823] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0036.823] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 1 [0036.824] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 0xffffffff [0036.824] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd8af29, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 1 [0036.824] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 0x20 [0036.825] VirtualAlloc (lpAddress=0x33a4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33a4000 [0036.825] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.825] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.826] ReadFile (in: hFile=0x104, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x106, lpOverlapped=0x0) returned 1 [0036.827] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x106, lpOverlapped=0x0) returned 1 [0036.827] ReadFile (in: hFile=0x104, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.827] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.827] CloseHandle (hObject=0x104) returned 1 [0036.827] CloseHandle (hObject=0x100) returned 1 [0036.828] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.crypt")) returned 0 [0036.828] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.crypt")) returned 0x20 [0036.828] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd8af29, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 0x5c90c0 [0036.828] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd8af29, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 0 [0036.828] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0036.828] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 1 [0036.829] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 0xffffffff [0036.829] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec119aaf, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0036.829] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 0x26 [0036.830] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.830] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.830] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x2e2, lpOverlapped=0x0) returned 1 [0036.832] WriteFile (in: hFile=0x104, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x2e2, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x2e2, lpOverlapped=0x0) returned 1 [0036.832] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.832] WriteFile (in: hFile=0x104, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.832] CloseHandle (hObject=0x100) returned 1 [0036.833] CloseHandle (hObject=0x104) returned 1 [0036.833] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.crypt")) returned 0 [0036.833] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.crypt")) returned 0x20 [0036.833] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec119aaf, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c90c0 [0036.833] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec119aaf, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0036.833] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0036.833] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 1 [0036.834] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 0xffffffff [0036.834] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6392a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5db, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0036.834] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 0x20 [0036.835] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.835] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.835] ReadFile (in: hFile=0x104, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x5db, lpOverlapped=0x0) returned 1 [0036.836] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x5db, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x5db, lpOverlapped=0x0) returned 1 [0036.837] ReadFile (in: hFile=0x104, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.837] WriteFile (in: hFile=0x100, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.837] CloseHandle (hObject=0x104) returned 1 [0036.837] CloseHandle (hObject=0x100) returned 1 [0036.838] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.crypt")) returned 0 [0036.838] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.crypt")) returned 0x20 [0036.838] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6392a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5db, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x5c90c0 [0036.838] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6392a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5db, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0036.838] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0036.838] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 1 [0036.839] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 0xffffffff [0036.839] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3d87bb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 1 [0036.839] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 0x20 [0036.839] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0036.839] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.840] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x51a, lpOverlapped=0x0) returned 1 [0036.842] WriteFile (in: hFile=0x104, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x51a, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x51a, lpOverlapped=0x0) returned 1 [0036.843] ReadFile (in: hFile=0x100, lpBuffer=0x18c588, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18c588*, lpNumberOfBytesRead=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.843] WriteFile (in: hFile=0x104, lpBuffer=0x18d588*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c2d4, lpOverlapped=0x0 | out: lpBuffer=0x18d588*, lpNumberOfBytesWritten=0x18c2d4*=0x0, lpOverlapped=0x0) returned 1 [0036.843] CloseHandle (hObject=0x100) returned 1 [0036.843] CloseHandle (hObject=0x104) returned 1 [0036.843] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.crypt")) returned 0 [0036.844] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.crypt")) returned 0x20 [0036.844] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3d87bb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0x5c90c0 [0036.844] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e424 | out: lpFindFileData=0x18e424*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3d87bb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0 [0036.844] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0036.844] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 1 [0036.845] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 0xffffffff [0036.845] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3d87bb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x5d1560, dwReserved1=0x18e534, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0 [0036.845] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.845] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc80587, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0036.845] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 0x20 [0036.845] VirtualAlloc (lpAddress=0x33a8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33a8000 [0036.846] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.846] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.846] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x4cc, lpOverlapped=0x0) returned 1 [0036.847] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x4cc, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x4cc, lpOverlapped=0x0) returned 1 [0036.848] ReadFile (in: hFile=0x108, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.848] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.848] CloseHandle (hObject=0x108) returned 1 [0036.848] CloseHandle (hObject=0x104) returned 1 [0036.849] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.crypt")) returned 0 [0036.849] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.crypt")) returned 0x20 [0036.849] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc80587, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x5c9080 [0036.849] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc80587, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0036.849] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.849] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 1 [0036.850] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 0xffffffff [0036.850] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc80587, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0036.850] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.850] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f6c, dwReserved1=0x6e6c2e72, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0036.850] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0036.850] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="..", cAlternateFileName="")) returned 1 [0036.850] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.850] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 0x26 [0036.851] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.851] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.851] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0xae, lpOverlapped=0x0) returned 1 [0036.852] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0xae, lpOverlapped=0x0) returned 1 [0036.853] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.853] WriteFile (in: hFile=0x108, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.853] CloseHandle (hObject=0x104) returned 1 [0036.853] CloseHandle (hObject=0x108) returned 1 [0036.853] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypt")) returned 0 [0036.853] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypt")) returned 0x20 [0036.853] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9080 [0036.853] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.853] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.853] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 1 [0036.854] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 0xffffffff [0036.854] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5d1560, dwReserved1=0x18e79c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.854] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.854] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x65726f6c, dwReserved1=0x6e6c2e72, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.854] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 0x26 [0036.855] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.855] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.855] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x1dc, lpOverlapped=0x0) returned 1 [0036.856] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x1dc, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x1dc, lpOverlapped=0x0) returned 1 [0036.857] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.857] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.857] CloseHandle (hObject=0xfc) returned 1 [0036.857] CloseHandle (hObject=0x108) returned 1 [0036.857] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypt")) returned 0 [0036.857] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypt")) returned 0x20 [0036.857] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9040 [0036.857] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.857] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.857] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 1 [0036.858] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 0xffffffff [0036.858] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0036.858] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 0x20 [0036.858] VirtualAlloc (lpAddress=0x33ac000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33ac000 [0036.859] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.859] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.859] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x587, lpOverlapped=0x0) returned 1 [0036.860] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x587, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x587, lpOverlapped=0x0) returned 1 [0036.862] ReadFile (in: hFile=0x108, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.862] WriteFile (in: hFile=0xfc, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.862] CloseHandle (hObject=0x108) returned 1 [0036.862] CloseHandle (hObject=0xfc) returned 1 [0036.862] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.crypt")) returned 0 [0036.862] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.crypt")) returned 0x20 [0036.862] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0x5c9040 [0036.862] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0 [0036.862] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.862] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 1 [0036.863] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 0xffffffff [0036.863] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6392a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x5d1560, dwReserved1=0x18ea04, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0036.863] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 0x20 [0036.863] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.864] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.864] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x5a9, lpOverlapped=0x0) returned 1 [0036.865] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x5a9, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x5a9, lpOverlapped=0x0) returned 1 [0036.866] ReadFile (in: hFile=0xfc, lpBuffer=0x18ca58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18ca58*, lpNumberOfBytesRead=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.866] WriteFile (in: hFile=0x108, lpBuffer=0x18da58*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c7a4, lpOverlapped=0x0 | out: lpBuffer=0x18da58*, lpNumberOfBytesWritten=0x18c7a4*=0x0, lpOverlapped=0x0) returned 1 [0036.866] CloseHandle (hObject=0xfc) returned 1 [0036.866] CloseHandle (hObject=0x108) returned 1 [0036.866] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.crypt")) returned 0 [0036.866] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.crypt")) returned 0x20 [0036.866] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6392a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x5c9040 [0036.867] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e8f4 | out: lpFindFileData=0x18e8f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6392a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0036.867] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.867] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 1 [0036.867] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 0xffffffff [0036.868] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ea04, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0036.868] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0036.868] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.868] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec165d69, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0xb8, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0036.868] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0x26 [0036.869] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.869] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.869] ReadFile (in: hFile=0xfc, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x13e, lpOverlapped=0x0) returned 1 [0036.870] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x13e, lpOverlapped=0x0) returned 1 [0036.871] ReadFile (in: hFile=0xfc, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.871] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.871] CloseHandle (hObject=0xfc) returned 1 [0036.871] CloseHandle (hObject=0x104) returned 1 [0036.871] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypt")) returned 0 [0036.871] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypt")) returned 0x20 [0036.871] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec165d69, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x5c9080 [0036.872] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec165d69, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0036.872] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.872] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 1 [0036.872] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0xffffffff [0036.872] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd3ec69, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5c8d98, dwReserved1=0x18e79c, cFileName="Help.lnk", cAlternateFileName="")) returned 1 [0036.873] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 0x20 [0036.873] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.873] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.873] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x106, lpOverlapped=0x0) returned 1 [0036.874] WriteFile (in: hFile=0xfc, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x106, lpOverlapped=0x0) returned 1 [0036.875] ReadFile (in: hFile=0x104, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.875] WriteFile (in: hFile=0xfc, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.875] CloseHandle (hObject=0x104) returned 1 [0036.875] CloseHandle (hObject=0xfc) returned 1 [0036.875] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.crypt")) returned 0 [0036.875] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.crypt")) returned 0x20 [0036.875] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd3ec69, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Help.lnk", cAlternateFileName="")) returned 0x5c9080 [0036.875] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd3ec69, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Help.lnk", cAlternateFileName="")) returned 0 [0036.875] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.875] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 1 [0036.876] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 0xffffffff [0036.876] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd3ec69, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x5c8d98, dwReserved1=0x18e79c, cFileName="Help.lnk", cAlternateFileName="")) returned 0 [0036.876] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.876] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ea04, cFileName="Startup", cAlternateFileName="")) returned 1 [0036.876] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0036.877] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.877] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.877] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 0x26 [0036.877] VirtualAlloc (lpAddress=0x33b0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33b0000 [0036.877] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0036.877] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0036.878] ReadFile (in: hFile=0xfc, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0xae, lpOverlapped=0x0) returned 1 [0036.878] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0xae, lpOverlapped=0x0) returned 1 [0036.879] ReadFile (in: hFile=0xfc, lpBuffer=0x18c7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18c7f0*, lpNumberOfBytesRead=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.879] WriteFile (in: hFile=0x104, lpBuffer=0x18d7f0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18c53c, lpOverlapped=0x0 | out: lpBuffer=0x18d7f0*, lpNumberOfBytesWritten=0x18c53c*=0x0, lpOverlapped=0x0) returned 1 [0036.879] CloseHandle (hObject=0xfc) returned 1 [0036.879] CloseHandle (hObject=0x104) returned 1 [0036.879] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypt")) returned 0 [0036.880] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypt")) returned 0x20 [0036.880] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c9080 [0036.880] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e68c | out: lpFindFileData=0x18e68c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.880] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0036.880] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 1 [0036.881] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 0xffffffff [0036.881] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.881] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0036.881] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ea04, cFileName="Startup", cAlternateFileName="")) returned 0 [0036.881] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.881] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18ec6c, cFileName="Programs", cAlternateFileName="")) returned 0 [0036.881] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.881] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0036.881] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.881] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="..", cAlternateFileName="")) returned 1 [0036.881] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="..", cAlternateFileName="")) returned 0 [0036.881] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.881] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Themes", cAlternateFileName="")) returned 1 [0036.881] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0036.882] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="..", cAlternateFileName="")) returned 1 [0036.882] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff982e02, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x9b944, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 1 [0036.882] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 0x2020 [0036.883] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0036.883] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0036.883] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.887] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.888] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.889] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.889] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.889] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.889] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.890] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.890] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.890] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.890] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.890] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.890] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.890] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.891] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.891] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.891] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.891] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.891] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.891] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.891] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.892] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.892] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.892] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.892] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.892] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.892] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.892] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.893] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.893] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.895] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.895] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.895] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.895] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.895] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.895] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.895] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.896] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.896] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.896] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.896] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.896] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.896] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.896] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.897] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.897] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.897] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.897] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.897] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.897] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.897] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.898] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.898] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.898] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.898] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.898] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.898] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.898] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.899] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.899] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.899] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.899] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.899] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.899] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.899] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.899] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.900] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.900] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.900] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.900] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.900] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.900] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.901] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.901] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.901] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.901] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.901] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.901] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.901] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.902] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.902] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.902] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.902] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.902] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.902] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.902] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.903] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.903] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.903] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.903] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.903] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.903] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.904] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.905] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.905] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.905] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.905] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.905] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.906] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.906] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.906] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.906] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.906] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.906] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.906] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.907] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.907] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.907] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.907] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.907] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.907] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.907] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.908] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.908] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.908] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.908] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.908] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.908] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.908] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.909] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.909] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.909] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.909] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.909] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.909] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.909] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.910] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.910] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.910] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.910] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.911] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.911] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.911] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.911] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.911] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.911] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.912] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.912] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.912] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.912] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.912] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.912] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.912] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.913] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.913] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.913] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.913] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.913] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.913] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.913] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.914] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.914] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.914] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.914] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.914] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.914] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.914] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.915] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.917] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.917] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.917] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.917] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.917] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.917] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.917] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.918] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.918] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.918] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.918] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.918] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.918] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.918] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.919] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.919] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.919] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.919] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.919] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.919] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.919] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.920] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.920] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.920] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.920] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.920] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.920] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.920] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.921] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.921] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.921] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.921] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.921] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.921] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.921] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.922] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.922] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.922] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.922] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.922] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.922] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.922] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.923] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.923] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.923] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.923] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.923] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.923] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.923] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.924] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.924] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.924] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.924] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.924] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.924] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.924] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.925] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.925] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.925] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.925] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.925] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.925] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.925] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.926] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.927] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.927] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.927] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.927] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.927] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.927] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.927] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.928] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.928] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.928] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.928] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.928] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.928] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.928] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.929] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.929] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.929] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.929] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.929] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.929] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.929] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.930] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.930] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.930] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.930] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.930] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.930] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.930] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.931] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.931] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.931] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.931] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.931] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.931] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.931] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.932] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.932] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.932] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.933] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.933] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.933] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.933] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.933] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.933] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.933] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.934] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.934] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.934] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.934] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.935] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.935] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.935] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.935] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.935] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.935] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.936] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.936] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.936] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.936] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.936] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.936] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.936] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.937] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.937] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.937] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.937] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.937] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.937] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.938] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.938] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.938] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.938] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.938] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.938] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.938] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.939] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.939] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.939] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.939] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.939] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.939] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.939] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.940] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.940] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.940] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.940] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.940] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.940] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x1000, lpOverlapped=0x0) returned 1 [0036.940] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x944, lpOverlapped=0x0) returned 1 [0036.941] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x944, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x944, lpOverlapped=0x0) returned 1 [0036.941] ReadFile (in: hFile=0x114, lpBuffer=0x18ccc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18ccc0*, lpNumberOfBytesRead=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.941] WriteFile (in: hFile=0x108, lpBuffer=0x18dcc0*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18ca0c, lpOverlapped=0x0 | out: lpBuffer=0x18dcc0*, lpNumberOfBytesWritten=0x18ca0c*=0x0, lpOverlapped=0x0) returned 1 [0036.941] CloseHandle (hObject=0x114) returned 1 [0036.941] CloseHandle (hObject=0x108) returned 1 [0036.941] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.crypt")) returned 0 [0036.941] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.crypt" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.crypt")) returned 0x2020 [0036.941] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff982e02, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x9b944, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0x5c9000 [0036.941] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eb5c | out: lpFindFileData=0x18eb5c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff982e02, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x9b944, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0 [0036.941] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0036.941] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 1 [0036.947] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 0xffffffff [0036.947] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff982e02, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x9b944, dwReserved0=0x726f6c70, dwReserved1=0x6c2e7265, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0 [0036.947] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0036.947] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Themes", cAlternateFileName="")) returned 0 [0036.947] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0036.947] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31363131, dwReserved1=0x34373533, cFileName="Windows", cAlternateFileName="")) returned 0 [0036.947] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.947] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0036.947] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.947] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="")) returned 0 [0036.947] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.947] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31373933, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0036.947] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0036.947] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31373933, cFileName="Contacts", cAlternateFileName="")) returned 1 [0036.948] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Contacts\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.948] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="..", cAlternateFileName="")) returned 1 [0036.948] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0036.948] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.948] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini")) returned 0x26 [0036.948] CreateFileA (lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0036.948] CreateFileA (lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini.crypt" (normalized: "c:\\users\\default\\contacts\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0036.949] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x19c, lpOverlapped=0x0) returned 1 [0036.950] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x19c, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x19c, lpOverlapped=0x0) returned 1 [0036.958] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0036.958] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0036.958] CloseHandle (hObject=0xec) returned 1 [0036.958] CloseHandle (hObject=0xe8) returned 1 [0036.958] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Contacts\\desktop.ini.crypt" (normalized: "c:\\users\\default\\contacts\\desktop.ini.crypt")) returned 0 [0036.958] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini.crypt" (normalized: "c:\\users\\default\\contacts\\desktop.ini.crypt")) returned 0x20 [0036.959] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0036.959] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.959] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.959] DeleteFileA (lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini")) returned 1 [0036.960] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini")) returned 0xffffffff [0036.960] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.960] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.960] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Cookies", cAlternateFileName="")) returned 1 [0036.960] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="desktop.ini", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0036.960] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Desktop", cAlternateFileName="")) returned 1 [0036.960] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.960] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0036.960] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.960] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini")) returned 0x26 [0036.960] VirtualAlloc (lpAddress=0x33b4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33b4000 [0036.961] CreateFileA (lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0036.961] CreateFileA (lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini.crypt" (normalized: "c:\\users\\default\\desktop\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0036.961] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x11a, lpOverlapped=0x0) returned 1 [0036.962] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x11a, lpOverlapped=0x0) returned 1 [0036.963] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0036.963] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0036.963] CloseHandle (hObject=0xe8) returned 1 [0036.963] CloseHandle (hObject=0xec) returned 1 [0036.963] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Desktop\\desktop.ini.crypt" (normalized: "c:\\users\\default\\desktop\\desktop.ini.crypt")) returned 0 [0036.963] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini.crypt" (normalized: "c:\\users\\default\\desktop\\desktop.ini.crypt")) returned 0x20 [0036.963] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0036.964] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.964] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.964] DeleteFileA (lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini")) returned 1 [0036.964] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini")) returned 0xffffffff [0036.965] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.965] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.965] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0036.965] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.966] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0036.966] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.966] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Documents\\desktop.ini" (normalized: "c:\\users\\default\\documents\\desktop.ini")) returned 0x26 [0036.966] CreateFileA (lpFileName="C:\\Users\\Default\\Documents\\desktop.ini" (normalized: "c:\\users\\default\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0036.966] CreateFileA (lpFileName="C:\\Users\\Default\\Documents\\desktop.ini.crypt" (normalized: "c:\\users\\default\\documents\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0036.966] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x192, lpOverlapped=0x0) returned 1 [0036.967] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x192, lpOverlapped=0x0) returned 1 [0036.968] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0036.968] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0036.968] CloseHandle (hObject=0xec) returned 1 [0036.968] CloseHandle (hObject=0xe8) returned 1 [0036.968] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Documents\\desktop.ini" (normalized: "c:\\users\\default\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Documents\\desktop.ini.crypt" (normalized: "c:\\users\\default\\documents\\desktop.ini.crypt")) returned 0 [0036.969] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Documents\\desktop.ini.crypt" (normalized: "c:\\users\\default\\documents\\desktop.ini.crypt")) returned 0x20 [0036.969] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0036.969] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.969] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.969] DeleteFileA (lpFileName="C:\\Users\\Default\\Documents\\desktop.ini" (normalized: "c:\\users\\default\\documents\\desktop.ini")) returned 1 [0036.970] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Documents\\desktop.ini" (normalized: "c:\\users\\default\\documents\\desktop.ini")) returned 0xffffffff [0036.970] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0036.970] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x77163472, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x5c8da0, ftLastAccessTime.dwLowDateTime=0xffffffff, ftLastAccessTime.dwHighDateTime=0x18f660, ftLastWriteTime.dwLowDateTime=0x211ec0, ftLastWriteTime.dwHighDateTime=0x5c8d98, nFileSizeHigh=0x18f640, nFileSizeLow=0x7715e688, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="\xa0\x8d\x5c", cAlternateFileName="")) returned 0xffffffff [0036.970] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0036.970] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x77163472, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x5c8da0, ftLastAccessTime.dwLowDateTime=0xffffffff, ftLastAccessTime.dwHighDateTime=0x18f660, ftLastWriteTime.dwLowDateTime=0x211ec0, ftLastWriteTime.dwHighDateTime=0x5c8d98, nFileSizeHigh=0x18f640, nFileSizeLow=0x7715e688, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="\xa0\x8d\x5c", cAlternateFileName="")) returned 0xffffffff [0036.970] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0036.970] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x77163472, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x5c8da0, ftLastAccessTime.dwLowDateTime=0xffffffff, ftLastAccessTime.dwHighDateTime=0x18f660, ftLastWriteTime.dwLowDateTime=0x211ec0, ftLastWriteTime.dwHighDateTime=0x5c8d98, nFileSizeHigh=0x18f640, nFileSizeLow=0x7715e688, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="\xa0\x8d\x5c", cAlternateFileName="")) returned 0xffffffff [0036.970] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0036.970] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.970] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0036.970] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.971] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0036.971] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.971] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini")) returned 0x26 [0036.972] CreateFileA (lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0036.972] CreateFileA (lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini.crypt" (normalized: "c:\\users\\default\\downloads\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0036.972] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x11a, lpOverlapped=0x0) returned 1 [0036.973] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x11a, lpOverlapped=0x0) returned 1 [0036.974] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0036.974] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0036.974] CloseHandle (hObject=0xe8) returned 1 [0036.974] CloseHandle (hObject=0xec) returned 1 [0036.974] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Downloads\\desktop.ini.crypt" (normalized: "c:\\users\\default\\downloads\\desktop.ini.crypt")) returned 0 [0036.974] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini.crypt" (normalized: "c:\\users\\default\\downloads\\desktop.ini.crypt")) returned 0x20 [0036.974] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0036.974] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.974] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.975] DeleteFileA (lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini")) returned 1 [0036.975] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini")) returned 0xffffffff [0036.975] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.975] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.976] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0036.976] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0036.979] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0036.979] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.979] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\desktop.ini")) returned 0x26 [0036.979] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0036.979] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\desktop.ini.crypt" (normalized: "c:\\users\\default\\favorites\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0036.982] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x192, lpOverlapped=0x0) returned 1 [0036.983] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x192, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x192, lpOverlapped=0x0) returned 1 [0036.985] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0036.985] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0036.985] CloseHandle (hObject=0xec) returned 1 [0036.985] CloseHandle (hObject=0xe8) returned 1 [0036.985] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Favorites\\desktop.ini.crypt" (normalized: "c:\\users\\default\\favorites\\desktop.ini.crypt")) returned 0 [0036.985] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\desktop.ini.crypt" (normalized: "c:\\users\\default\\favorites\\desktop.ini.crypt")) returned 0x20 [0036.985] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0036.985] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.985] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.985] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\desktop.ini")) returned 1 [0036.986] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\desktop.ini")) returned 0xffffffff [0036.986] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Links", cAlternateFileName="")) returned 1 [0036.986] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0036.987] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.987] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x4c, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0036.987] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini")) returned 0x26 [0036.987] VirtualAlloc (lpAddress=0x33b8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33b8000 [0036.987] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0036.987] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini.crypt" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0036.988] ReadFile (in: hFile=0xec, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x50, lpOverlapped=0x0) returned 1 [0036.988] WriteFile (in: hFile=0xf4, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x50, lpOverlapped=0x0) returned 1 [0036.990] ReadFile (in: hFile=0xec, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0036.990] WriteFile (in: hFile=0xf4, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0036.990] CloseHandle (hObject=0xec) returned 1 [0036.990] CloseHandle (hObject=0xf4) returned 1 [0036.990] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini.crypt" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini.crypt")) returned 0 [0036.990] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini.crypt" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini.crypt")) returned 0x20 [0036.990] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0036.990] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0036.990] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0036.990] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini")) returned 1 [0036.991] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini")) returned 0xffffffff [0036.991] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0036.991] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0036.991] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.991] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x752e7972, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0036.991] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0036.993] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="..", cAlternateFileName="")) returned 1 [0036.993] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0036.993] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0036.993] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0036.993] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0036.993] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0036.993] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0036.993] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.994] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x6c72752e, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0036.994] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0036.995] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="..", cAlternateFileName="")) returned 1 [0036.995] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0036.995] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0036.996] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0036.996] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0036.996] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0036.996] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0036.996] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0036.996] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.997] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0036.997] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0036.998] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="..", cAlternateFileName="")) returned 1 [0036.998] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0036.998] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0036.998] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0036.998] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0036.998] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0036.998] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0036.999] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0036.999] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0036.999] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69736265, dwReserved1=0x61736574, cFileName="Links", cAlternateFileName="")) returned 1 [0036.999] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0037.000] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName="..", cAlternateFileName="")) returned 1 [0037.000] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.001] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\desktop.ini" (normalized: "c:\\users\\default\\links\\desktop.ini")) returned 0x26 [0037.001] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\desktop.ini" (normalized: "c:\\users\\default\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.001] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\desktop.ini.crypt" (normalized: "c:\\users\\default\\links\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.002] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x244, lpOverlapped=0x0) returned 1 [0037.003] WriteFile (in: hFile=0xf4, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x244, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x244, lpOverlapped=0x0) returned 1 [0037.003] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.003] WriteFile (in: hFile=0xf4, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.003] CloseHandle (hObject=0xe8) returned 1 [0037.003] CloseHandle (hObject=0xf4) returned 1 [0037.004] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\desktop.ini" (normalized: "c:\\users\\default\\links\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Links\\desktop.ini.crypt" (normalized: "c:\\users\\default\\links\\desktop.ini.crypt")) returned 0 [0037.004] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\desktop.ini.crypt" (normalized: "c:\\users\\default\\links\\desktop.ini.crypt")) returned 0x20 [0037.004] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f00 [0037.004] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.004] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.004] DeleteFileA (lpFileName="C:\\Users\\Default\\Links\\desktop.ini" (normalized: "c:\\users\\default\\links\\desktop.ini")) returned 1 [0037.005] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\desktop.ini" (normalized: "c:\\users\\default\\links\\desktop.ini")) returned 0xffffffff [0037.005] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0037.005] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk")) returned 0x20 [0037.005] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.005] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk.crypt" (normalized: "c:\\users\\default\\links\\desktop.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.006] ReadFile (in: hFile=0xf4, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1d3, lpOverlapped=0x0) returned 1 [0037.006] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1d3, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1d3, lpOverlapped=0x0) returned 1 [0037.007] ReadFile (in: hFile=0xf4, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.007] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.007] CloseHandle (hObject=0xf4) returned 1 [0037.007] CloseHandle (hObject=0xe8) returned 1 [0037.007] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Desktop.lnk.crypt" (normalized: "c:\\users\\default\\links\\desktop.lnk.crypt")) returned 0 [0037.008] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk.crypt" (normalized: "c:\\users\\default\\links\\desktop.lnk.crypt")) returned 0x20 [0037.008] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.lnk", cAlternateFileName="")) returned 0x5c8f00 [0037.008] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desktop.lnk", cAlternateFileName="")) returned 0 [0037.008] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.008] DeleteFileA (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk")) returned 1 [0037.009] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk")) returned 0xffffffff [0037.009] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0037.009] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk")) returned 0x20 [0037.009] VirtualAlloc (lpAddress=0x33bc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33bc000 [0037.009] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.009] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk.crypt" (normalized: "c:\\users\\default\\links\\downloads.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.010] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x37e, lpOverlapped=0x0) returned 1 [0037.011] WriteFile (in: hFile=0xf4, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x37e, lpOverlapped=0x0) returned 1 [0037.012] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.012] WriteFile (in: hFile=0xf4, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.012] CloseHandle (hObject=0xe8) returned 1 [0037.012] CloseHandle (hObject=0xf4) returned 1 [0037.012] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Downloads.lnk.crypt" (normalized: "c:\\users\\default\\links\\downloads.lnk.crypt")) returned 0 [0037.012] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk.crypt" (normalized: "c:\\users\\default\\links\\downloads.lnk.crypt")) returned 0x20 [0037.012] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 0x5c8f00 [0037.013] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 0 [0037.013] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.013] DeleteFileA (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk")) returned 1 [0037.013] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk")) returned 0xffffffff [0037.013] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0037.014] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk")) returned 0x20 [0037.014] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.014] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk.crypt" (normalized: "c:\\users\\default\\links\\recentplaces.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.014] ReadFile (in: hFile=0xf4, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x16b, lpOverlapped=0x0) returned 1 [0037.015] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x16b, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x16b, lpOverlapped=0x0) returned 1 [0037.016] ReadFile (in: hFile=0xf4, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.016] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.016] CloseHandle (hObject=0xf4) returned 1 [0037.016] CloseHandle (hObject=0xe8) returned 1 [0037.016] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk.crypt" (normalized: "c:\\users\\default\\links\\recentplaces.lnk.crypt")) returned 0 [0037.016] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk.crypt" (normalized: "c:\\users\\default\\links\\recentplaces.lnk.crypt")) returned 0x20 [0037.016] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0x5c8f00 [0037.017] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0037.017] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.017] DeleteFileA (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk")) returned 1 [0037.017] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk")) returned 0xffffffff [0037.017] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0037.018] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.018] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0037.018] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="RecentPlaces.lnk", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0037.018] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="Music", cAlternateFileName="")) returned 1 [0037.018] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0037.018] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0037.018] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.018] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini")) returned 0x26 [0037.019] CreateFileA (lpFileName="C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.019] CreateFileA (lpFileName="C:\\Users\\Default\\Music\\desktop.ini.crypt" (normalized: "c:\\users\\default\\music\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.019] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1f8, lpOverlapped=0x0) returned 1 [0037.020] WriteFile (in: hFile=0xf4, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1f8, lpOverlapped=0x0) returned 1 [0037.021] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.021] WriteFile (in: hFile=0xf4, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.021] CloseHandle (hObject=0xe8) returned 1 [0037.021] CloseHandle (hObject=0xf4) returned 1 [0037.021] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Music\\desktop.ini.crypt" (normalized: "c:\\users\\default\\music\\desktop.ini.crypt")) returned 0 [0037.021] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Music\\desktop.ini.crypt" (normalized: "c:\\users\\default\\music\\desktop.ini.crypt")) returned 0x20 [0037.021] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Music\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0037.021] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.021] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.021] DeleteFileA (lpFileName="C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini")) returned 1 [0037.022] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini")) returned 0xffffffff [0037.022] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.022] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.022] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0037.022] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0037.022] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="NetHood", cAlternateFileName="")) returned 1 [0037.022] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0037.022] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0037.022] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1 [0037.022] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x674ac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0037.023] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0037.023] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0037.023] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0037.023] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0037.023] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0037.023] GetFileAttributesA (lpFileName="C:\\Users\\Default\\ntuser.ini" (normalized: "c:\\users\\default\\ntuser.ini")) returned 0x2026 [0037.023] CreateFileA (lpFileName="C:\\Users\\Default\\ntuser.ini" (normalized: "c:\\users\\default\\ntuser.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.023] CreateFileA (lpFileName="C:\\Users\\Default\\ntuser.ini.crypt" (normalized: "c:\\users\\default\\ntuser.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.024] ReadFile (in: hFile=0xf8, lpBuffer=0x18d8c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d614, lpOverlapped=0x0 | out: lpBuffer=0x18d8c8*, lpNumberOfBytesRead=0x18d614*=0x14, lpOverlapped=0x0) returned 1 [0037.024] WriteFile (in: hFile=0xf4, lpBuffer=0x18e8c8*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x18d614, lpOverlapped=0x0 | out: lpBuffer=0x18e8c8*, lpNumberOfBytesWritten=0x18d614*=0x14, lpOverlapped=0x0) returned 1 [0037.025] ReadFile (in: hFile=0xf8, lpBuffer=0x18d8c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d614, lpOverlapped=0x0 | out: lpBuffer=0x18d8c8*, lpNumberOfBytesRead=0x18d614*=0x0, lpOverlapped=0x0) returned 1 [0037.025] WriteFile (in: hFile=0xf4, lpBuffer=0x18e8c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d614, lpOverlapped=0x0 | out: lpBuffer=0x18e8c8*, lpNumberOfBytesWritten=0x18d614*=0x0, lpOverlapped=0x0) returned 1 [0037.025] CloseHandle (hObject=0xf8) returned 1 [0037.025] CloseHandle (hObject=0xf4) returned 1 [0037.025] MoveFileA (lpExistingFileName="C:\\Users\\Default\\ntuser.ini" (normalized: "c:\\users\\default\\ntuser.ini"), lpNewFileName="C:\\Users\\Default\\ntuser.ini.crypt" (normalized: "c:\\users\\default\\ntuser.ini.crypt")) returned 0 [0037.026] GetFileAttributesA (lpFileName="C:\\Users\\Default\\ntuser.ini.crypt" (normalized: "c:\\users\\default\\ntuser.ini.crypt")) returned 0x20 [0037.026] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\ntuser.ini", lpFindFileData=0x18f764 | out: lpFindFileData=0x18f764*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="ntuser.ini", cAlternateFileName="")) returned 0x5c8ec0 [0037.026] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f764 | out: lpFindFileData=0x18f764*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="ntuser.ini", cAlternateFileName="")) returned 0 [0037.026] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.026] DeleteFileA (lpFileName="C:\\Users\\Default\\ntuser.ini" (normalized: "c:\\users\\default\\ntuser.ini")) returned 1 [0037.027] GetFileAttributesA (lpFileName="C:\\Users\\Default\\ntuser.ini" (normalized: "c:\\users\\default\\ntuser.ini")) returned 0xffffffff [0037.027] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0037.027] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0037.027] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.027] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x36, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.027] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini")) returned 0x26 [0037.028] VirtualAlloc (lpAddress=0x33c0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33c0000 [0037.028] CreateFileA (lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.028] CreateFileA (lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini.crypt" (normalized: "c:\\users\\default\\pictures\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.029] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1f8, lpOverlapped=0x0) returned 1 [0037.029] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1f8, lpOverlapped=0x0) returned 1 [0037.030] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.030] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.031] CloseHandle (hObject=0xf8) returned 1 [0037.031] CloseHandle (hObject=0xe8) returned 1 [0037.031] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Pictures\\desktop.ini.crypt" (normalized: "c:\\users\\default\\pictures\\desktop.ini.crypt")) returned 0 [0037.031] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini.crypt" (normalized: "c:\\users\\default\\pictures\\desktop.ini.crypt")) returned 0x20 [0037.031] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f00 [0037.031] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.031] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.031] DeleteFileA (lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini")) returned 1 [0037.032] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini")) returned 0xffffffff [0037.032] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x36, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.032] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.032] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0037.032] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x36, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0037.032] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0037.032] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x36, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0037.032] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0037.032] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0037.033] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0037.033] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.033] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini")) returned 0x26 [0037.033] CreateFileA (lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.033] CreateFileA (lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini.crypt" (normalized: "c:\\users\\default\\saved games\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.033] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x11a, lpOverlapped=0x0) returned 1 [0037.034] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x11a, lpOverlapped=0x0) returned 1 [0037.035] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.035] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.035] CloseHandle (hObject=0xe8) returned 1 [0037.035] CloseHandle (hObject=0xf8) returned 1 [0037.035] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Saved Games\\desktop.ini.crypt" (normalized: "c:\\users\\default\\saved games\\desktop.ini.crypt")) returned 0 [0037.036] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini.crypt" (normalized: "c:\\users\\default\\saved games\\desktop.ini.crypt")) returned 0x20 [0037.036] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f00 [0037.036] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.036] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.036] DeleteFileA (lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini")) returned 1 [0037.037] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini")) returned 0xffffffff [0037.037] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.037] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.037] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0037.037] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Searches\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0037.039] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0037.039] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.039] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini")) returned 0x26 [0037.039] CreateFileA (lpFileName="C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.039] CreateFileA (lpFileName="C:\\Users\\Default\\Searches\\desktop.ini.crypt" (normalized: "c:\\users\\default\\searches\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.039] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x20c, lpOverlapped=0x0) returned 1 [0037.040] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x20c, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x20c, lpOverlapped=0x0) returned 1 [0037.041] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.041] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.041] CloseHandle (hObject=0xf8) returned 1 [0037.041] CloseHandle (hObject=0xe8) returned 1 [0037.041] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Searches\\desktop.ini.crypt" (normalized: "c:\\users\\default\\searches\\desktop.ini.crypt")) returned 0 [0037.041] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Searches\\desktop.ini.crypt" (normalized: "c:\\users\\default\\searches\\desktop.ini.crypt")) returned 0x20 [0037.041] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Searches\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f00 [0037.042] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.042] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.042] DeleteFileA (lpFileName="C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini")) returned 1 [0037.042] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini")) returned 0xffffffff [0037.042] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0037.043] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0037.043] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0037.043] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.043] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="SendTo", cAlternateFileName="")) returned 1 [0037.043] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Indexed Locations.search-ms", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0037.043] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0037.044] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Indexed Locations.search-ms", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0037.044] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0037.044] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Indexed Locations.search-ms", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0037.044] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Videos", cAlternateFileName="")) returned 1 [0037.044] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0037.044] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0037.044] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.044] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Videos\\desktop.ini" (normalized: "c:\\users\\default\\videos\\desktop.ini")) returned 0x26 [0037.044] VirtualAlloc (lpAddress=0x33c4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33c4000 [0037.045] CreateFileA (lpFileName="C:\\Users\\Default\\Videos\\desktop.ini" (normalized: "c:\\users\\default\\videos\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.045] CreateFileA (lpFileName="C:\\Users\\Default\\Videos\\desktop.ini.crypt" (normalized: "c:\\users\\default\\videos\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.045] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x1f8, lpOverlapped=0x0) returned 1 [0037.046] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x1f8, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x1f8, lpOverlapped=0x0) returned 1 [0037.047] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.047] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.047] CloseHandle (hObject=0xe8) returned 1 [0037.047] CloseHandle (hObject=0xf8) returned 1 [0037.047] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Videos\\desktop.ini" (normalized: "c:\\users\\default\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Videos\\desktop.ini.crypt" (normalized: "c:\\users\\default\\videos\\desktop.ini.crypt")) returned 0 [0037.047] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Videos\\desktop.ini.crypt" (normalized: "c:\\users\\default\\videos\\desktop.ini.crypt")) returned 0x20 [0037.047] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Videos\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0037.047] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.047] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.047] DeleteFileA (lpFileName="C:\\Users\\Default\\Videos\\desktop.ini" (normalized: "c:\\users\\default\\videos\\desktop.ini")) returned 1 [0037.048] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Videos\\desktop.ini" (normalized: "c:\\users\\default\\videos\\desktop.ini")) returned 0xffffffff [0037.048] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.048] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.048] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Videos", cAlternateFileName="")) returned 0 [0037.048] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0037.048] FindNextFileA (in: hFindFile=0x5c3c68, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x64623838, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0037.048] FindFirstFileA (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Videos", cAlternateFileName="h<\\")) returned 0xffffffff [0037.049] FindNextFileA (in: hFindFile=0x5c3c68, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x64623838, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.049] GetFileAttributesA (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini")) returned 0x26 [0037.049] CreateFileA (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.049] CreateFileA (lpFileName="C:\\Users\\desktop.ini.crypt" (normalized: "c:\\users\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0037.049] ReadFile (in: hFile=0xdc, lpBuffer=0x18db30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d87c, lpOverlapped=0x0 | out: lpBuffer=0x18db30*, lpNumberOfBytesRead=0x18d87c*=0xae, lpOverlapped=0x0) returned 1 [0037.050] WriteFile (in: hFile=0xf4, lpBuffer=0x18eb30*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18d87c, lpOverlapped=0x0 | out: lpBuffer=0x18eb30*, lpNumberOfBytesWritten=0x18d87c*=0xae, lpOverlapped=0x0) returned 1 [0037.051] ReadFile (in: hFile=0xdc, lpBuffer=0x18db30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d87c, lpOverlapped=0x0 | out: lpBuffer=0x18db30*, lpNumberOfBytesRead=0x18d87c*=0x0, lpOverlapped=0x0) returned 1 [0037.051] WriteFile (in: hFile=0xf4, lpBuffer=0x18eb30*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d87c, lpOverlapped=0x0 | out: lpBuffer=0x18eb30*, lpNumberOfBytesWritten=0x18d87c*=0x0, lpOverlapped=0x0) returned 1 [0037.051] CloseHandle (hObject=0xdc) returned 1 [0037.051] CloseHandle (hObject=0xf4) returned 1 [0037.051] MoveFileA (lpExistingFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), lpNewFileName="C:\\Users\\desktop.ini.crypt" (normalized: "c:\\users\\desktop.ini.crypt")) returned 0 [0037.051] GetFileAttributesA (lpFileName="C:\\Users\\desktop.ini.crypt" (normalized: "c:\\users\\desktop.ini.crypt")) returned 0x20 [0037.051] FindFirstFileA (in: lpFileName="C:\\Users\\desktop.ini", lpFindFileData=0x18f9cc | out: lpFindFileData=0x18f9cc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8e80 [0037.051] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18f9cc | out: lpFindFileData=0x18f9cc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.052] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0037.052] DeleteFileA (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini")) returned 1 [0037.052] GetFileAttributesA (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini")) returned 0xffffffff [0037.052] FindNextFileA (in: hFindFile=0x5c3c68, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18fadc, cFileName="Public", cAlternateFileName="")) returned 1 [0037.052] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0037.053] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.053] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x28, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0037.053] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0037.053] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.053] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c4db20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x7e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0037.053] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk")) returned 0x20 [0037.053] CreateFileA (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.053] CreateFileA (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk.crypt" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.054] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x7e9, lpOverlapped=0x0) returned 1 [0037.054] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x7e9, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x7e9, lpOverlapped=0x0) returned 1 [0037.055] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.055] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.055] CloseHandle (hObject=0xf8) returned 1 [0037.055] CloseHandle (hObject=0xe8) returned 1 [0037.055] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk.crypt" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk.crypt")) returned 0 [0037.056] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk.crypt" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk.crypt")) returned 0x20 [0037.056] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c4db20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x7e9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 0x5c8f00 [0037.056] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c4db20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x7e9, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 0 [0037.056] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.056] DeleteFileA (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk")) returned 1 [0037.057] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk")) returned 0xffffffff [0037.057] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.057] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini")) returned 0x26 [0037.057] CreateFileA (lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.057] CreateFileA (lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini.crypt" (normalized: "c:\\users\\public\\desktop\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.058] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0xae, lpOverlapped=0x0) returned 1 [0037.058] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0xae, lpOverlapped=0x0) returned 1 [0037.059] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.059] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.059] CloseHandle (hObject=0xe8) returned 1 [0037.059] CloseHandle (hObject=0xf8) returned 1 [0037.059] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Desktop\\desktop.ini.crypt" (normalized: "c:\\users\\public\\desktop\\desktop.ini.crypt")) returned 0 [0037.060] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini.crypt" (normalized: "c:\\users\\public\\desktop\\desktop.ini.crypt")) returned 0x20 [0037.060] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f00 [0037.060] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.060] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.060] DeleteFileA (lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini")) returned 1 [0037.061] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini")) returned 0xffffffff [0037.061] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0037.061] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk")) returned 0x20 [0037.061] VirtualAlloc (lpAddress=0x33c8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33c8000 [0037.061] CreateFileA (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.061] CreateFileA (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.crypt" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.062] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x8d1, lpOverlapped=0x0) returned 1 [0037.062] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x8d1, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x8d1, lpOverlapped=0x0) returned 1 [0037.064] ReadFile (in: hFile=0xf8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.064] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.064] CloseHandle (hObject=0xf8) returned 1 [0037.064] CloseHandle (hObject=0xe8) returned 1 [0037.064] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.crypt" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.crypt")) returned 0 [0037.064] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.crypt" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.crypt")) returned 0x20 [0037.064] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d1, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0x5c8f00 [0037.064] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d1, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 0 [0037.064] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.064] DeleteFileA (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk")) returned 1 [0037.065] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk")) returned 0xffffffff [0037.065] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0037.065] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk")) returned 0x20 [0037.065] CreateFileA (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.065] CreateFileA (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.crypt" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.066] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x485, lpOverlapped=0x0) returned 1 [0037.067] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x485, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x485, lpOverlapped=0x0) returned 1 [0037.067] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.067] WriteFile (in: hFile=0xf8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.068] CloseHandle (hObject=0xe8) returned 1 [0037.068] CloseHandle (hObject=0xf8) returned 1 [0037.068] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.crypt" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.crypt")) returned 0 [0037.068] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.crypt" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.crypt")) returned 0x20 [0037.068] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0x5c8f00 [0037.068] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0037.068] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.068] DeleteFileA (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk")) returned 1 [0037.069] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk")) returned 0xffffffff [0037.069] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0037.069] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.069] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x786f6665, dwReserved1=0x6b6e6c2e, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.069] GetFileAttributesA (lpFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini")) returned 0x26 [0037.069] CreateFileA (lpFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.069] CreateFileA (lpFileName="C:\\Users\\Public\\desktop.ini.crypt" (normalized: "c:\\users\\public\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0037.070] ReadFile (in: hFile=0xdc, lpBuffer=0x18d8c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d614, lpOverlapped=0x0 | out: lpBuffer=0x18d8c8*, lpNumberOfBytesRead=0x18d614*=0xae, lpOverlapped=0x0) returned 1 [0037.070] WriteFile (in: hFile=0xf8, lpBuffer=0x18e8c8*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18d614, lpOverlapped=0x0 | out: lpBuffer=0x18e8c8*, lpNumberOfBytesWritten=0x18d614*=0xae, lpOverlapped=0x0) returned 1 [0037.072] ReadFile (in: hFile=0xdc, lpBuffer=0x18d8c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d614, lpOverlapped=0x0 | out: lpBuffer=0x18d8c8*, lpNumberOfBytesRead=0x18d614*=0x0, lpOverlapped=0x0) returned 1 [0037.072] WriteFile (in: hFile=0xf8, lpBuffer=0x18e8c8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d614, lpOverlapped=0x0 | out: lpBuffer=0x18e8c8*, lpNumberOfBytesWritten=0x18d614*=0x0, lpOverlapped=0x0) returned 1 [0037.072] CloseHandle (hObject=0xdc) returned 1 [0037.072] CloseHandle (hObject=0xf8) returned 1 [0037.072] MoveFileA (lpExistingFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\desktop.ini.crypt" (normalized: "c:\\users\\public\\desktop.ini.crypt")) returned 0 [0037.072] GetFileAttributesA (lpFileName="C:\\Users\\Public\\desktop.ini.crypt" (normalized: "c:\\users\\public\\desktop.ini.crypt")) returned 0x20 [0037.072] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\desktop.ini", lpFindFileData=0x18f764 | out: lpFindFileData=0x18f764*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f00 [0037.073] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f764 | out: lpFindFileData=0x18f764*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.073] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.073] DeleteFileA (lpFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini")) returned 1 [0037.073] GetFileAttributesA (lpFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini")) returned 0xffffffff [0037.073] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0037.074] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0037.074] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.074] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x36, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.074] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini")) returned 0x26 [0037.074] VirtualAlloc (lpAddress=0x33cc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33cc000 [0037.220] CreateFileA (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.220] CreateFileA (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini.crypt" (normalized: "c:\\users\\public\\documents\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.221] ReadFile (in: hFile=0xdc, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x116, lpOverlapped=0x0) returned 1 [0037.221] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x116, lpOverlapped=0x0) returned 1 [0037.222] ReadFile (in: hFile=0xdc, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.222] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.222] CloseHandle (hObject=0xdc) returned 1 [0037.222] CloseHandle (hObject=0xe8) returned 1 [0037.222] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Documents\\desktop.ini.crypt" (normalized: "c:\\users\\public\\documents\\desktop.ini.crypt")) returned 0 [0037.223] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini.crypt" (normalized: "c:\\users\\public\\documents\\desktop.ini.crypt")) returned 0x20 [0037.223] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0037.223] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.223] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.223] DeleteFileA (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini")) returned 1 [0037.224] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini")) returned 0xffffffff [0037.224] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0037.224] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x77163472, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x5c8da0, ftLastAccessTime.dwLowDateTime=0xffffffff, ftLastAccessTime.dwHighDateTime=0x18f660, ftLastWriteTime.dwLowDateTime=0x211ec0, ftLastWriteTime.dwHighDateTime=0x5c8d98, nFileSizeHigh=0x18f640, nFileSizeLow=0x7715e688, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="\xa0\x8d\x5c", cAlternateFileName="")) returned 0xffffffff [0037.224] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0037.224] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x77163472, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x5c8da0, ftLastAccessTime.dwLowDateTime=0xffffffff, ftLastAccessTime.dwHighDateTime=0x18f660, ftLastWriteTime.dwLowDateTime=0x211ec0, ftLastWriteTime.dwHighDateTime=0x5c8d98, nFileSizeHigh=0x18f640, nFileSizeLow=0x7715e688, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="\xa0\x8d\x5c", cAlternateFileName="")) returned 0xffffffff [0037.224] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0037.224] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x77163472, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x5c8da0, ftLastAccessTime.dwLowDateTime=0xffffffff, ftLastAccessTime.dwHighDateTime=0x18f660, ftLastWriteTime.dwLowDateTime=0x211ec0, ftLastWriteTime.dwHighDateTime=0x5c8d98, nFileSizeHigh=0x18f640, nFileSizeLow=0x7715e688, dwReserved0=0x5a0000, dwReserved1=0x0, cFileName="\xa0\x8d\x5c", cAlternateFileName="")) returned 0xffffffff [0037.224] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0037.224] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.224] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0037.224] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0037.225] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0037.225] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.225] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini")) returned 0x26 [0037.225] CreateFileA (lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.225] CreateFileA (lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini.crypt" (normalized: "c:\\users\\public\\downloads\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.225] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0xae, lpOverlapped=0x0) returned 1 [0037.226] WriteFile (in: hFile=0xdc, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0xae, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0xae, lpOverlapped=0x0) returned 1 [0037.227] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.227] WriteFile (in: hFile=0xdc, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.227] CloseHandle (hObject=0xe8) returned 1 [0037.227] CloseHandle (hObject=0xdc) returned 1 [0037.227] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Downloads\\desktop.ini.crypt" (normalized: "c:\\users\\public\\downloads\\desktop.ini.crypt")) returned 0 [0037.227] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini.crypt" (normalized: "c:\\users\\public\\downloads\\desktop.ini.crypt")) returned 0x20 [0037.227] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0037.228] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.228] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.228] DeleteFileA (lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini")) returned 1 [0037.228] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini")) returned 0xffffffff [0037.229] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.229] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.229] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0037.229] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Favorites\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0037.229] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0037.229] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 0 [0037.229] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.229] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0037.229] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0037.229] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0037.229] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2839e1d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2839e1d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288f9359, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x58, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.229] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini")) returned 0x26 [0037.230] CreateFileA (lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.230] CreateFileA (lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini.crypt" (normalized: "c:\\users\\public\\libraries\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.231] ReadFile (in: hFile=0xdc, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x58, lpOverlapped=0x0) returned 1 [0037.232] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x58, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x58, lpOverlapped=0x0) returned 1 [0037.233] ReadFile (in: hFile=0xdc, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.233] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.233] CloseHandle (hObject=0xdc) returned 1 [0037.233] CloseHandle (hObject=0xe8) returned 1 [0037.233] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Libraries\\desktop.ini.crypt" (normalized: "c:\\users\\public\\libraries\\desktop.ini.crypt")) returned 0 [0037.233] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini.crypt" (normalized: "c:\\users\\public\\libraries\\desktop.ini.crypt")) returned 0x20 [0037.233] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2839e1d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2839e1d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288f9359, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x58, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0037.234] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2839e1d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2839e1d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288f9359, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x58, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.234] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.234] DeleteFileA (lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini")) returned 1 [0037.235] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini")) returned 0xffffffff [0037.235] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0037.235] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0037.235] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.235] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7262696c, dwReserved1=0x2d797261, cFileName="Music", cAlternateFileName="")) returned 1 [0037.235] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0037.235] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="..", cAlternateFileName="")) returned 1 [0037.235] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.235] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini")) returned 0x26 [0037.235] CreateFileA (lpFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.235] CreateFileA (lpFileName="C:\\Users\\Public\\Music\\desktop.ini.crypt" (normalized: "c:\\users\\public\\music\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.236] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x17c, lpOverlapped=0x0) returned 1 [0037.236] WriteFile (in: hFile=0xdc, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x17c, lpOverlapped=0x0) returned 1 [0037.237] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.237] WriteFile (in: hFile=0xdc, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.237] CloseHandle (hObject=0xe8) returned 1 [0037.237] CloseHandle (hObject=0xdc) returned 1 [0037.237] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Music\\desktop.ini.crypt" (normalized: "c:\\users\\public\\music\\desktop.ini.crypt")) returned 0 [0037.237] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Music\\desktop.ini.crypt" (normalized: "c:\\users\\public\\music\\desktop.ini.crypt")) returned 0x20 [0037.238] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Music\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f00 [0037.238] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.238] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.238] DeleteFileA (lpFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini")) returned 1 [0037.238] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini")) returned 0xffffffff [0037.239] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0037.239] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0037.240] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.240] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x42, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.240] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\sample music\\desktop.ini")) returned 0x26 [0037.241] VirtualAlloc (lpAddress=0x33d0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33d0000 [0037.241] CreateFileA (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\sample music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.241] CreateFileA (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\desktop.ini.crypt" (normalized: "c:\\users\\public\\music\\sample music\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0037.242] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x24a, lpOverlapped=0x0) returned 1 [0037.242] WriteFile (in: hFile=0xec, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x24a, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x24a, lpOverlapped=0x0) returned 1 [0037.243] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.243] WriteFile (in: hFile=0xec, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.243] CloseHandle (hObject=0xe8) returned 1 [0037.243] CloseHandle (hObject=0xec) returned 1 [0037.244] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\sample music\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\desktop.ini.crypt" (normalized: "c:\\users\\public\\music\\sample music\\desktop.ini.crypt")) returned 0 [0037.244] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\desktop.ini.crypt" (normalized: "c:\\users\\public\\music\\sample music\\desktop.ini.crypt")) returned 0x20 [0037.244] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\desktop.ini", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0037.244] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.244] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0037.244] DeleteFileA (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\sample music\\desktop.ini")) returned 1 [0037.245] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\sample music\\desktop.ini")) returned 0xffffffff [0037.245] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Kalimba.mp3", cAlternateFileName="")) returned 1 [0037.245] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be5ebf7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Maid with the Flaxen Hair.mp3", cAlternateFileName="MAIDWI~1.MP3")) returned 1 [0037.245] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 1 [0037.245] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 0 [0037.245] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.245] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0037.245] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.245] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72626963, dwReserved1=0x2d797261, cFileName="Pictures", cAlternateFileName="")) returned 1 [0037.245] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4633706d, dwReserved1=0x6578616c, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0037.245] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4633706d, dwReserved1=0x6578616c, cFileName="..", cAlternateFileName="")) returned 1 [0037.245] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x4633706d, dwReserved1=0x6578616c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.245] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini")) returned 0x26 [0037.246] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.246] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini.crypt" (normalized: "c:\\users\\public\\pictures\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0037.246] ReadFile (in: hFile=0xdc, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x17c, lpOverlapped=0x0) returned 1 [0037.247] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x17c, lpOverlapped=0x0) returned 1 [0037.248] ReadFile (in: hFile=0xdc, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.248] WriteFile (in: hFile=0xec, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.248] CloseHandle (hObject=0xdc) returned 1 [0037.248] CloseHandle (hObject=0xec) returned 1 [0037.248] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Pictures\\desktop.ini.crypt" (normalized: "c:\\users\\public\\pictures\\desktop.ini.crypt")) returned 0 [0037.248] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini.crypt" (normalized: "c:\\users\\public\\pictures\\desktop.ini.crypt")) returned 0x20 [0037.248] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f00 [0037.248] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.248] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.248] DeleteFileA (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini")) returned 1 [0037.249] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini")) returned 0xffffffff [0037.249] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0037.249] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0037.251] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x48, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.251] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x48, dwReserved1=0x0, cFileName="Chrysanthemum.jpg", cAlternateFileName="CHRYSA~1.JPG")) returned 1 [0037.251] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg")) returned 0x20 [0037.252] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.252] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.252] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.254] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.255] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.257] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.257] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.258] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.258] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.258] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.258] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.258] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.258] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.258] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.259] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.259] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.259] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.259] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.259] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.259] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.259] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.260] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.260] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.260] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.260] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.260] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.260] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.260] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.261] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.261] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.261] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.267] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.267] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.268] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.268] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.268] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.268] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.268] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.268] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.268] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.269] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.269] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.269] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.269] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.269] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.269] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.269] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.270] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.270] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.270] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.270] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.270] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.270] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.270] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.271] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.271] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.271] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.271] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.271] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.271] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.271] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.272] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.272] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.272] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.272] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.272] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.272] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.272] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.273] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.273] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.273] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.273] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.273] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.273] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.273] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.274] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.274] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.274] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.274] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.274] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.274] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.274] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.274] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.275] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.275] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.275] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.275] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.275] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.275] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.275] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.276] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.276] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.276] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.276] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.276] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.277] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.277] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.278] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.278] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.278] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.278] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.278] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.278] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.278] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.279] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.279] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.279] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.279] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.279] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.279] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.279] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.280] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.280] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.280] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.280] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.280] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.280] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.280] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.281] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.281] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.281] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.281] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.281] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.281] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.281] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.282] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.282] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.282] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.282] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.282] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.282] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.282] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.283] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.283] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.284] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.284] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.284] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.284] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.284] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.284] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.284] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.284] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.285] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.285] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.285] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.285] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.285] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.285] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.285] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.286] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.286] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.286] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.286] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.286] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.286] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.286] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.287] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.287] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.287] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.289] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.289] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.289] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.289] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.289] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.289] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.290] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.290] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.290] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.290] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.290] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.290] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.290] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.290] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.291] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.291] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.291] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.291] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.291] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.291] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.291] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.291] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.292] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.292] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.292] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.292] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.292] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.292] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.292] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.293] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.293] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.293] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.293] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.293] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.293] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.293] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.294] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.294] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.294] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.294] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.294] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.294] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.294] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.295] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.295] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.295] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.295] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.295] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.295] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.295] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.296] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.296] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.296] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.296] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.296] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.296] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.296] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.297] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.297] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.297] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.297] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.297] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.297] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.297] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.299] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.299] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.299] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.299] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.299] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.299] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.300] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.300] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.300] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.300] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.300] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.300] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.300] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.301] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.301] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.301] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.301] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.301] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.301] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.301] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.302] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.302] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.302] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.302] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.302] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.302] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.302] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.303] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.303] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.303] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.303] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.303] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.303] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.303] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.304] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.304] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.304] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.305] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.305] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.305] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.305] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.305] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.305] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.305] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.306] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.306] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.306] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.306] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.306] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.306] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.306] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.307] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.307] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.307] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.307] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.307] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.307] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.308] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.308] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.308] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.308] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.308] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.308] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.309] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.310] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.310] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.311] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.311] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.311] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.311] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.311] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.311] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.312] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.312] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.312] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.312] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.312] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.312] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.312] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.313] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.313] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.313] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.313] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.313] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.313] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.313] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.314] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.314] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.314] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.314] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.314] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.314] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.314] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.315] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.315] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.315] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.315] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.315] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.315] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.315] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.316] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.316] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.316] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.316] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.316] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.316] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.317] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.317] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.317] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.317] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.317] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.317] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.317] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.318] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.318] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.318] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.318] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.318] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.318] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.318] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.319] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.319] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.319] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.319] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.319] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.319] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.319] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.320] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.320] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.321] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.321] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.321] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.321] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.321] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.321] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.321] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.322] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.322] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.322] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.322] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.322] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.322] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.322] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.323] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.323] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.323] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.323] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.323] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.323] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.323] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.324] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.324] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.324] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.324] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.324] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.324] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.325] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.325] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.325] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.325] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.325] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.325] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.325] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.326] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.326] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.327] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.327] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.327] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.327] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.327] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.327] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.327] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.328] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.328] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.328] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.328] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.328] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.328] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.328] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.329] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.329] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.329] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.329] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.329] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.329] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.329] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.330] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.330] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.330] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.330] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.330] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.330] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.331] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.331] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.331] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.331] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.331] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.331] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.331] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.332] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.332] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.332] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.332] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.332] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.332] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.332] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.333] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.333] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xb22, lpOverlapped=0x0) returned 1 [0037.333] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xb22, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xb22, lpOverlapped=0x0) returned 1 [0037.333] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.333] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.333] CloseHandle (hObject=0xdc) returned 1 [0037.333] CloseHandle (hObject=0xe8) returned 1 [0037.333] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.crypt")) returned 0 [0037.334] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.crypt")) returned 0x20 [0037.334] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Chrysanthemum.jpg", cAlternateFileName="CHRYSA~1.JPG")) returned 0x5c8f40 [0037.334] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Chrysanthemum.jpg", cAlternateFileName="CHRYSA~1.JPG")) returned 0 [0037.334] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0037.334] DeleteFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg")) returned 1 [0037.341] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg")) returned 0xffffffff [0037.341] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.jpg", cAlternateFileName="")) returned 1 [0037.341] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg")) returned 0x20 [0037.342] VirtualAlloc (lpAddress=0x33d4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33d4000 [0037.342] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.342] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.342] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.345] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.345] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.346] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.346] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.347] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.347] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.347] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.347] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.347] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.347] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.347] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.348] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.348] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.348] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.348] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.348] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.348] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.348] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.348] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.349] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.349] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.349] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.349] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.349] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.349] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.349] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.350] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.350] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.351] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.351] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.351] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.352] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.352] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.352] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.352] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.352] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.352] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.352] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.353] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.353] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.353] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.353] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.353] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.353] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.353] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.354] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.354] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.354] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.354] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.354] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.354] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.354] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.354] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.355] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.355] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.355] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.355] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.355] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.355] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.355] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.356] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.356] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.356] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.356] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.356] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.356] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.356] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.357] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.357] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.357] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.357] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.357] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.357] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.357] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.358] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.358] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.358] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.358] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.358] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.358] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.358] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.359] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.359] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.359] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.359] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.359] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.359] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.359] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.359] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.360] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.360] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.360] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.361] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.361] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.361] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.361] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.362] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.362] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.362] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.362] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.362] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.362] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.362] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.362] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.363] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.363] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.363] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.363] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.363] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.363] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.363] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.363] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.364] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.364] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.364] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.364] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.364] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.364] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.364] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.365] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.365] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.365] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.365] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.365] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.365] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.365] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.365] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.366] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.366] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.366] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.367] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.367] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.367] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.367] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.367] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.367] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.367] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.368] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.368] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.368] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.368] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.368] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.368] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.368] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.368] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.369] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.369] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.369] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.369] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.369] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.369] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.369] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.369] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.370] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.370] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.370] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.373] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.373] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.373] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.373] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.373] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.374] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.374] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.374] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.374] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.374] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.374] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.374] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.375] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.375] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.375] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.375] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.375] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.375] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.375] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.375] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.376] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.376] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.376] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.376] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.376] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.376] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.376] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.377] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.377] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.377] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.377] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.377] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.377] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.377] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.378] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.378] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.378] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.378] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.378] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.378] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.378] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.378] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.379] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.379] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.379] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.379] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.379] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.379] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.379] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.380] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.380] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.380] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.380] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.380] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.380] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.380] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.381] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.381] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.381] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.381] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.381] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.381] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.381] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.382] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.383] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.383] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.383] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.383] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.383] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.383] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.384] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.384] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.384] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.384] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.384] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.384] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.384] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.385] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.385] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.385] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.385] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.385] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.385] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.385] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.386] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.386] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.386] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.386] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.386] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.386] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.386] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.386] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.387] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.387] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.387] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.387] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.387] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.387] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.387] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.388] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.388] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.389] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.389] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.389] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.389] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.389] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.389] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.389] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.390] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.390] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.390] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.390] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.390] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.390] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.390] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.390] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.391] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.391] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.391] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.391] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.391] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.391] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.391] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.392] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.392] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.392] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.392] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.392] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.394] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.394] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.394] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.394] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.395] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.395] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.395] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.395] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.395] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.395] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.395] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.396] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.396] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.396] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.396] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.396] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.396] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.396] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.397] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.397] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.397] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.397] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.397] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.397] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.397] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.397] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.398] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.398] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.398] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.398] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.398] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.398] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.398] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.399] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.399] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.399] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.399] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.399] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.399] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.399] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.400] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.400] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.400] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.400] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.400] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.400] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.400] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.401] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.401] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.401] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.401] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.401] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.401] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.401] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.401] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.402] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.402] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.402] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.402] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.402] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.402] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.403] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.403] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.403] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.403] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.403] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.403] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.404] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.404] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.404] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.404] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.404] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.404] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.404] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.405] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.405] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.405] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.405] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.405] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.405] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.405] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.406] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.406] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.406] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.406] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.406] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.406] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.406] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.407] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.407] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.407] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.407] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.407] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.407] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.407] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.408] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.408] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.408] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.408] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.408] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.408] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.409] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.409] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.409] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.410] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.410] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.410] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.410] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.410] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.410] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.410] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.411] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.411] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.411] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.411] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.411] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.411] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.411] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.412] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.412] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.412] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.412] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.412] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.412] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.412] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.413] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.413] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.413] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x875, lpOverlapped=0x0) returned 1 [0037.413] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x875, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x875, lpOverlapped=0x0) returned 1 [0037.413] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.413] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.413] CloseHandle (hObject=0xe8) returned 1 [0037.413] CloseHandle (hObject=0xdc) returned 1 [0037.413] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.crypt")) returned 0 [0037.414] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.crypt")) returned 0x20 [0037.414] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desert.jpg", cAlternateFileName="")) returned 0x5c8f40 [0037.414] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Desert.jpg", cAlternateFileName="")) returned 0 [0037.414] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0037.414] DeleteFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg")) returned 1 [0037.421] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg")) returned 0xffffffff [0037.421] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.421] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desktop.ini")) returned 0x26 [0037.422] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.422] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.422] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x460, lpOverlapped=0x0) returned 1 [0037.424] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x460, lpOverlapped=0x0) returned 1 [0037.425] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.425] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.425] CloseHandle (hObject=0xdc) returned 1 [0037.425] CloseHandle (hObject=0xe8) returned 1 [0037.425] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desktop.ini.crypt")) returned 0 [0037.425] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desktop.ini.crypt")) returned 0x20 [0037.425] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0037.425] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.425] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0037.425] DeleteFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desktop.ini")) returned 1 [0037.426] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desktop.ini")) returned 0xffffffff [0037.426] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Hydrangeas.jpg", cAlternateFileName="HYDRAN~1.JPG")) returned 1 [0037.426] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg")) returned 0x20 [0037.426] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.427] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.427] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.431] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.432] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.433] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.433] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.433] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.434] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.434] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.434] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.434] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.434] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.434] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.434] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.435] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.435] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.435] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.435] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.435] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.435] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.435] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.435] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.436] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.436] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.436] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.436] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.436] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.436] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.436] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.437] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.438] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.438] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.438] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.439] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.439] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.439] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.439] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.439] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.439] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.439] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.440] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.440] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.440] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.440] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.440] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.440] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.440] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.441] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.441] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.441] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.441] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.441] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.441] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.441] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.441] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.442] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.442] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.442] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.442] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.442] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.442] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.442] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.443] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.443] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.443] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.443] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.443] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.443] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.443] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.444] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.444] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.444] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.444] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.444] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.444] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.444] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.445] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.445] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.445] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.445] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.445] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.445] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.445] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.445] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.446] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.446] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.446] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.446] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.446] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.446] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.446] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.447] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.447] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.447] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.448] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.448] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.448] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.449] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.449] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.449] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.449] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.449] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.449] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.449] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.450] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.450] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.450] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.450] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.450] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.450] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.450] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.450] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.451] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.451] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.451] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.451] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.451] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.451] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.451] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.452] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.452] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.452] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.452] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.452] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.452] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.452] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.453] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.453] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.453] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.453] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.453] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.454] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.454] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.454] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.454] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.454] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.455] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.455] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.455] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.455] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.455] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.455] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.455] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.456] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.456] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.456] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.456] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.456] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.456] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.456] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.456] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.457] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.457] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.457] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.457] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.457] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.457] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.457] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.459] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.459] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.459] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.460] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.460] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.460] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.460] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.460] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.460] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.460] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.461] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.461] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.461] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.461] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.461] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.461] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.461] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.461] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.462] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.462] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.462] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.462] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.462] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.462] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.462] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.463] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.463] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.463] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.463] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.463] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.463] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.463] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.464] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.464] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.464] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.464] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.464] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.464] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.465] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.465] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.465] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.465] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.465] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.465] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.465] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.465] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.466] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.466] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.466] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.466] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.466] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.466] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.466] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.467] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.467] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.467] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.467] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.467] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.467] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.467] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.468] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.468] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.468] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.468] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.469] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.469] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.469] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.469] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.469] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.469] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.470] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.470] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.470] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.470] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.470] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.470] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.470] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.470] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.471] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.471] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.471] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.471] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.471] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.471] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.471] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.472] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.472] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.472] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.472] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.472] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.472] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.472] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.473] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.473] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.473] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.473] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.473] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.473] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.473] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.474] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.474] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.474] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.475] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.475] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.475] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.475] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.475] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.475] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.475] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.476] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.476] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.476] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.476] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.476] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.476] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.476] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.477] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.477] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.477] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.477] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.477] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.477] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.477] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.478] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.478] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.478] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.478] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.478] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.478] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.478] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.479] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.479] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.479] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.479] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x554, lpOverlapped=0x0) returned 1 [0037.479] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x554, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x554, lpOverlapped=0x0) returned 1 [0037.479] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.479] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.479] CloseHandle (hObject=0xe8) returned 1 [0037.479] CloseHandle (hObject=0xdc) returned 1 [0037.479] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.crypt")) returned 0 [0037.480] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.crypt")) returned 0x20 [0037.480] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Hydrangeas.jpg", cAlternateFileName="HYDRAN~1.JPG")) returned 0x5c8f40 [0037.480] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Hydrangeas.jpg", cAlternateFileName="HYDRAN~1.JPG")) returned 0 [0037.480] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0037.480] DeleteFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg")) returned 1 [0037.485] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg")) returned 0xffffffff [0037.485] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Jellyfish.jpg", cAlternateFileName="JELLYF~1.JPG")) returned 1 [0037.485] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg")) returned 0x20 [0037.488] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.488] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.488] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.492] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.493] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.494] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.494] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.494] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.494] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.495] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.495] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.495] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.495] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.496] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.496] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.496] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.496] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.496] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.496] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.496] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.497] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.497] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.497] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.497] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.497] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.497] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.497] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.498] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.499] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.499] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.500] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.500] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.500] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.500] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.500] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.500] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.500] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.501] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.501] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.501] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.501] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.501] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.501] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.501] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.501] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.502] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.502] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.502] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.502] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.502] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.502] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.502] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.503] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.503] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.503] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.503] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.504] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.504] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.504] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.504] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.504] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.505] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.505] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.505] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.505] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.506] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.506] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.506] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.506] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.506] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.507] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.507] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.507] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.507] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.508] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.508] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.508] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.508] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.509] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.509] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.510] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.510] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.510] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.510] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.511] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.511] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.511] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.511] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.511] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.511] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.511] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.512] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.512] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.512] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.512] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.512] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.512] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.512] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.513] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.513] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.513] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.513] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.513] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.513] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.513] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.514] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.514] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.514] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.514] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.514] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.514] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.514] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.515] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.515] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.515] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.516] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.516] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.516] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.516] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.516] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.516] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.516] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.517] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.517] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.517] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.517] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.517] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.517] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.517] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.518] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.518] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.518] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.518] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.518] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.518] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.518] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.518] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.519] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.519] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.521] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.521] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.521] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.521] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.521] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.521] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.521] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.522] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.522] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.522] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.522] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.522] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.522] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.522] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.523] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.523] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.523] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.523] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.523] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.523] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.523] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.523] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.524] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.524] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.524] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.524] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.524] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.524] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.524] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.525] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.525] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.525] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.525] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.525] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.525] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.525] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.526] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.526] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.526] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.526] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.526] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.526] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.526] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.527] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.527] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.527] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.527] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.527] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.527] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.527] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.528] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.528] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.528] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.528] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.528] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.528] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.528] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.529] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.529] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.529] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.529] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.529] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.529] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.529] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.531] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.531] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.531] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.531] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.531] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.531] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.531] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.532] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.532] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.532] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.532] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.532] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.532] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.532] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.533] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.533] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.533] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.533] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.533] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.533] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.533] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.534] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.534] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.534] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.534] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.534] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.534] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.534] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.535] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.535] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.535] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.535] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.535] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.535] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.535] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.535] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.536] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.536] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.537] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.537] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.537] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.537] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.537] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.537] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.537] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.537] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.538] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.538] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.538] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.538] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.538] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.538] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.538] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.539] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.539] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.539] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.539] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.539] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.539] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.539] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.540] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.540] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.540] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.540] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.541] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.541] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.541] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.541] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.541] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.542] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.542] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.542] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.542] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.542] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.542] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.543] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.543] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.543] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.543] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.543] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.543] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.543] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.544] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.544] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.544] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.544] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.544] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.544] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.544] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.545] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.545] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.545] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.545] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.545] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.545] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.545] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.546] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.546] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.546] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.546] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.546] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.546] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.546] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.547] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.547] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.547] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.547] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.547] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.547] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.547] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.547] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.548] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.548] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.548] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.548] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.548] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.548] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.549] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.549] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.549] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.549] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.549] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.549] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.549] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.550] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.550] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.550] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.550] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.550] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.550] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.551] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.551] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.551] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.551] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.551] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.551] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.551] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.552] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.552] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.552] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.552] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.552] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.552] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.552] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.553] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.553] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.553] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.553] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.553] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.553] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.553] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.554] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.554] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.554] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.554] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.554] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.554] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.555] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x616, lpOverlapped=0x0) returned 1 [0037.555] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x616, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x616, lpOverlapped=0x0) returned 1 [0037.555] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.555] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.555] CloseHandle (hObject=0xdc) returned 1 [0037.555] CloseHandle (hObject=0xe8) returned 1 [0037.555] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.crypt")) returned 0 [0037.555] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.crypt")) returned 0x20 [0037.555] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Jellyfish.jpg", cAlternateFileName="JELLYF~1.JPG")) returned 0x5c8f40 [0037.555] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Jellyfish.jpg", cAlternateFileName="JELLYF~1.JPG")) returned 0 [0037.556] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0037.556] DeleteFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg")) returned 1 [0037.562] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg")) returned 0xffffffff [0037.562] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Koala.jpg", cAlternateFileName="")) returned 1 [0037.562] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg")) returned 0x20 [0037.562] VirtualAlloc (lpAddress=0x33d8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33d8000 [0037.563] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.563] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.563] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.565] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.566] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.567] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.567] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.567] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.567] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.568] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.568] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.568] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.568] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.568] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.568] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.568] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.569] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.569] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.569] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.569] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.569] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.569] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.569] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.569] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.570] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.570] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.570] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.570] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.570] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.570] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.570] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.572] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.572] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.572] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.572] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.573] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.573] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.573] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.573] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.573] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.573] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.574] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.574] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.574] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.574] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.574] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.574] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.574] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.574] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.575] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.575] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.575] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.575] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.575] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.575] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.575] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.576] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.576] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.576] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.576] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.576] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.576] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.576] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.577] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.577] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.577] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.577] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.577] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.577] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.577] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.577] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.578] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.578] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.578] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.578] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.578] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.578] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.578] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.579] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.579] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.579] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.579] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.579] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.579] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.579] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.580] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.580] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.580] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.580] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.580] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.580] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.580] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.581] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.581] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.581] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.582] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.582] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.582] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.582] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.582] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.583] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.583] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.583] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.583] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.583] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.583] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.583] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.584] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.584] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.584] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.584] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.584] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.584] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.584] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.585] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.585] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.585] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.585] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.585] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.585] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.585] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.586] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.586] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.586] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.586] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.586] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.586] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.586] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.586] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.587] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.587] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.587] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.588] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.588] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.588] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.588] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.588] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.588] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.588] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.589] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.589] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.589] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.589] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.589] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.589] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.590] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.590] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.590] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.590] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.590] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.590] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.590] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.591] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.591] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.591] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.591] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.591] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.591] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.591] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.593] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.593] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.593] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.594] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.594] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.594] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.594] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.594] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.594] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.594] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.595] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.595] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.595] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.595] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.595] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.595] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.595] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.596] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.596] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.596] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.596] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.596] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.596] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.596] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.596] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.597] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.597] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.597] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.597] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.597] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.597] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.597] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.598] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.598] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.598] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.598] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.598] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.598] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.598] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.599] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.599] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.599] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.599] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.599] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.599] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.599] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.600] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.600] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.600] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.600] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.600] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.600] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.600] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.601] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.601] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.601] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.601] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.601] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.601] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.601] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.601] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.602] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.602] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.602] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.603] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.603] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.603] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.603] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.604] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.604] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.604] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.604] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.604] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.604] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.605] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.605] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.605] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.605] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.605] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.605] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.605] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.605] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.606] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.606] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.606] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.606] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.606] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.606] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.606] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.607] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.607] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.607] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.607] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.607] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.607] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.607] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.608] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.608] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.608] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.608] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.608] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.609] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.609] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.609] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.609] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.609] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.610] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.610] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.610] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.610] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.610] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.610] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.610] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.611] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.611] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.611] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.611] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.611] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.611] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.611] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.612] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.612] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.612] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.612] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.612] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.612] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.612] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.612] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.614] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.614] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.614] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.615] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.615] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.615] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.615] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.615] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.615] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.615] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.616] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.616] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.616] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.616] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.616] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.616] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.616] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.617] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.617] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.617] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.617] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.617] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.617] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.617] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.618] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.618] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.618] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.618] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.618] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.618] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.618] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.619] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.619] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.619] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.619] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.619] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.619] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.619] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.620] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.620] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.620] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.620] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.620] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.621] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.621] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.621] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.621] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.621] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.621] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.621] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.622] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.622] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.622] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.622] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.622] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.622] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.622] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.623] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.623] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.623] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.623] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.623] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.623] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.624] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.624] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.624] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.624] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.624] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.624] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.624] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.625] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.625] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.625] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.625] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.625] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.625] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.625] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.626] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.626] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.626] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.626] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.626] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.626] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.626] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.627] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.627] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.627] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.627] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.627] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.627] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.627] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.628] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.628] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.628] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.628] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.628] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xa1f, lpOverlapped=0x0) returned 1 [0037.628] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xa1f, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xa1f, lpOverlapped=0x0) returned 1 [0037.628] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.628] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.629] CloseHandle (hObject=0xe8) returned 1 [0037.629] CloseHandle (hObject=0xdc) returned 1 [0037.629] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.crypt")) returned 0 [0037.629] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.crypt")) returned 0x20 [0037.629] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Koala.jpg", cAlternateFileName="")) returned 0x5c8f40 [0037.629] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Koala.jpg", cAlternateFileName="")) returned 0 [0037.629] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0037.629] DeleteFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg")) returned 1 [0037.635] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg")) returned 0xffffffff [0037.635] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Lighthouse.jpg", cAlternateFileName="LIGHTH~1.JPG")) returned 1 [0037.636] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg")) returned 0x20 [0037.636] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.637] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.637] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.639] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.640] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.641] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.641] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.641] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.642] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.642] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.642] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.642] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.642] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.642] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.642] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.642] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.643] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.643] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.643] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.643] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.643] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.643] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.643] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.644] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.644] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.644] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.644] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.644] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.644] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.644] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.645] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.646] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.646] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.646] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.647] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.647] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.647] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.647] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.647] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.647] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.647] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.648] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.648] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.648] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.648] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.648] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.648] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.648] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.649] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.649] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.649] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.649] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.649] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.649] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.649] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.649] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.650] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.650] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.650] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.650] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.650] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.650] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.650] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.651] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.651] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.651] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.651] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.651] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.672] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.672] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.672] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.672] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.672] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.673] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.673] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.673] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.673] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.673] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.673] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.674] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.674] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.674] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.674] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.674] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.674] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.674] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.675] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.675] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.675] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.675] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.675] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.675] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.675] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.676] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.676] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.677] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.677] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.678] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.678] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.678] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.678] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.678] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.678] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.678] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.679] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.679] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.679] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.679] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.679] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.679] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.679] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.680] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.680] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.680] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.680] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.680] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.680] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.680] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.681] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.681] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.681] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.681] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.681] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.681] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.681] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.682] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.682] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.682] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.682] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.682] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.682] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.683] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.683] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.684] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.684] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.684] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.684] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.684] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.684] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.684] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.685] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.685] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.685] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.685] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.685] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.685] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.686] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.686] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.686] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.686] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.686] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.686] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.686] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.687] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.687] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.687] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.687] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.687] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.687] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.689] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.689] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.689] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.689] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.690] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.690] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.690] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.690] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.690] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.690] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.691] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.691] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.691] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.691] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.691] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.691] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.691] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.691] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.692] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.692] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.692] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.692] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.692] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.692] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.692] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.693] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.693] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.693] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.693] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.693] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.693] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.693] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.694] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.694] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.694] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.694] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.694] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.694] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.694] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.695] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.695] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.695] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.695] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.695] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.695] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.695] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.696] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.696] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.696] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.696] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.696] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.696] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.696] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.697] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.697] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.697] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.697] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.697] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.697] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.697] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.698] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.698] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.698] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.698] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.698] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.699] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.699] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.699] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.699] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.699] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.699] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.700] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.700] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.700] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.700] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.700] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.700] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.700] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.701] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.701] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.701] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.701] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.701] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.701] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.702] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.702] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.702] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.702] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.702] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.702] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.702] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.703] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.703] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.703] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.703] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.703] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.703] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.704] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.704] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.704] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.704] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.705] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.705] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.705] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.705] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.705] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.705] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.706] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.706] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.706] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.706] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.706] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.706] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.706] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.707] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.707] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.707] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.707] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x7c, lpOverlapped=0x0) returned 1 [0037.707] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x7c, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x7c, lpOverlapped=0x0) returned 1 [0037.707] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.707] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.707] CloseHandle (hObject=0xdc) returned 1 [0037.707] CloseHandle (hObject=0xe8) returned 1 [0037.708] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.crypt")) returned 0 [0037.708] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.crypt")) returned 0x20 [0037.708] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Lighthouse.jpg", cAlternateFileName="LIGHTH~1.JPG")) returned 0x5c8f40 [0037.708] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Lighthouse.jpg", cAlternateFileName="LIGHTH~1.JPG")) returned 0 [0037.708] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0037.708] DeleteFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg")) returned 1 [0037.713] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg")) returned 0xffffffff [0037.713] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Penguins.jpg", cAlternateFileName="")) returned 1 [0037.713] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg")) returned 0x20 [0037.713] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.714] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.714] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.717] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.717] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.718] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.718] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.719] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.719] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.719] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.719] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.719] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.719] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.719] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.719] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.720] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.720] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.720] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.720] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.720] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.720] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.720] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.721] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.721] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.721] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.721] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.721] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.721] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.721] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.722] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.722] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.724] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.724] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.724] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.724] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.724] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.724] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.724] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.725] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.725] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.725] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.725] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.725] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.725] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.725] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.725] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.726] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.726] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.726] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.726] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.726] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.726] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.726] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.727] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.727] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.727] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.727] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.727] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.727] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.727] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.727] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.728] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.728] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.728] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.728] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.728] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.728] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.728] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.729] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.729] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.729] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.729] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.729] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.730] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.730] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.730] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.730] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.730] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.730] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.730] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.731] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.731] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.731] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.731] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.731] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.731] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.731] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.732] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.732] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.732] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.732] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.732] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.732] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.732] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.733] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.734] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.734] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.734] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.734] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.734] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.737] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.737] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.737] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.737] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.737] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.738] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.738] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.738] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.738] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.738] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.738] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.738] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.739] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.739] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.739] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.739] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.739] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.740] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.740] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.740] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.740] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.741] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.741] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.741] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.741] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.742] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.742] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.742] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.743] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.743] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.743] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.743] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.744] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.744] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.744] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.744] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.745] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.745] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.745] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.745] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.745] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.746] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.746] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.746] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.746] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.746] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.746] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.747] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.748] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.748] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.748] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.749] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.749] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.749] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.749] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.749] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.749] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.749] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.750] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.750] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.750] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.750] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.750] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.750] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.750] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.751] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.751] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.751] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.751] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.751] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.751] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.751] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.752] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.752] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.752] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.752] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.752] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.752] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.752] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.753] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.753] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.753] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.753] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.754] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.754] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.754] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.754] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.754] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.755] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.755] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.755] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.755] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.756] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.756] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.756] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.756] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.756] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.757] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.757] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.757] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.757] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.758] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.758] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.758] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.758] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.759] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.759] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.759] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.759] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.759] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.759] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.759] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.760] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.760] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.760] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.760] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.760] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.760] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.761] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.761] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.761] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.761] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.761] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.761] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.761] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.762] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.762] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.762] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.762] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.762] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.762] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.762] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.763] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.763] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.763] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.763] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.763] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.763] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.764] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.764] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.764] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.765] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.765] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.765] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.765] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.765] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.765] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.765] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.766] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.766] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.766] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.766] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.766] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.766] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.766] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.767] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.767] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.767] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.767] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.767] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.767] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.767] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.768] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.768] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.768] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.769] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.769] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.769] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.769] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.769] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.769] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.770] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.770] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.770] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.770] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.770] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.770] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.770] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.771] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.771] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.771] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.771] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.771] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.771] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.771] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.771] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.772] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.772] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.772] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.772] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.772] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.772] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.773] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.773] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.773] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.773] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.773] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.773] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.773] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.774] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.774] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.774] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.774] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.774] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.774] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.774] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.775] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.775] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.775] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.775] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.775] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.775] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.775] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.775] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.776] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.776] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.776] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.776] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.776] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.776] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.777] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.777] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.777] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.777] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.777] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.777] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.777] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.778] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.778] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.778] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.778] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.778] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.778] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.778] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.779] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.779] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.779] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.779] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.779] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.779] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.779] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.779] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.780] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.780] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.780] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.780] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.780] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.780] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.781] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.781] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.781] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.781] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.781] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.781] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.781] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.781] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.782] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.782] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.782] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xe6b, lpOverlapped=0x0) returned 1 [0037.782] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xe6b, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xe6b, lpOverlapped=0x0) returned 1 [0037.782] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.782] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.782] CloseHandle (hObject=0xe8) returned 1 [0037.782] CloseHandle (hObject=0xdc) returned 1 [0037.782] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.crypt")) returned 0 [0037.783] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.crypt")) returned 0x20 [0037.783] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Penguins.jpg", cAlternateFileName="")) returned 0x5c8f40 [0037.783] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="Penguins.jpg", cAlternateFileName="")) returned 0 [0037.783] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0037.783] DeleteFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg")) returned 1 [0037.789] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg")) returned 0xffffffff [0037.789] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Tulips.jpg", cAlternateFileName="")) returned 1 [0037.789] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg")) returned 0x20 [0037.789] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.790] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.790] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.792] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.793] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.794] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.794] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.794] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.795] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.795] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.795] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.795] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.795] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.795] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.796] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.796] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.796] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.796] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.796] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.796] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.796] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.797] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.797] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.797] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.797] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.797] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.797] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.797] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.798] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.798] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.798] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.800] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.800] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.800] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.800] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.800] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.801] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.801] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.801] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.801] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.801] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.801] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.801] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.802] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.802] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.802] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.802] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.802] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.802] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.802] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.803] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.803] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.803] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.803] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.803] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.803] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.803] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.804] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.804] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.804] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.804] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.804] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.804] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.805] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.805] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.805] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.805] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.805] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.805] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.806] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.806] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.806] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.806] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.806] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.806] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.806] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.807] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.807] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.807] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.807] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.807] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.807] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.808] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.808] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.808] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.808] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.808] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.808] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.809] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.809] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.809] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.809] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.809] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.809] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.809] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.810] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.811] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.811] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.811] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.811] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.811] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.811] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.811] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.812] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.812] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.812] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.812] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.812] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.812] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.812] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.813] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.813] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.813] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.813] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.813] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.813] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.813] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.814] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.814] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.814] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.814] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.814] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.814] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.815] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.815] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.815] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.815] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.815] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.815] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.815] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.816] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.816] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.816] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.817] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.817] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.817] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.817] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.817] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.817] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.818] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.818] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.818] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.818] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.818] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.818] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.818] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.818] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.819] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.819] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.819] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.819] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.819] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.819] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.819] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.820] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.820] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.820] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.820] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.820] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.822] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.822] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.822] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.822] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.822] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.823] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.823] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.823] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.823] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.823] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.823] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.824] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.824] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.824] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.824] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.824] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.824] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.824] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.825] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.825] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.825] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.825] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.825] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.825] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.825] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.826] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.826] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.826] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.826] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.826] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.826] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.826] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.827] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.827] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.827] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.827] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.827] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.827] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.827] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.828] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.828] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.828] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.828] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.828] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.828] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.829] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.829] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.829] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.829] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.829] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.829] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.829] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.829] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.830] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.830] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.830] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.830] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.830] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.830] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.830] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.831] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.831] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.831] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.832] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.832] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.832] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.833] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.833] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.833] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.833] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.833] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.833] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.834] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.834] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.834] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.834] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.834] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.834] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.834] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.834] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.835] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.835] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.835] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.835] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.835] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.835] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.835] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.836] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.836] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.836] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.836] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.836] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.836] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.836] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.837] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.837] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.837] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.837] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.838] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.838] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.838] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.838] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.838] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.838] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.839] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.839] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.839] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.839] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.839] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.839] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.839] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.840] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.840] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.840] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.840] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.840] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.840] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.840] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.841] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.841] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.841] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.841] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.841] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.841] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.841] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.842] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.842] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.842] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.842] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.842] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.842] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.842] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.843] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.843] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.843] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.843] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.843] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.843] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.843] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.843] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.844] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.844] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x1000, lpOverlapped=0x0) returned 1 [0037.844] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x958, lpOverlapped=0x0) returned 1 [0037.844] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x958, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x958, lpOverlapped=0x0) returned 1 [0037.844] ReadFile (in: hFile=0xdc, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.844] WriteFile (in: hFile=0xe8, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.844] CloseHandle (hObject=0xdc) returned 1 [0037.844] CloseHandle (hObject=0xe8) returned 1 [0037.844] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.crypt")) returned 0 [0037.845] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.crypt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.crypt")) returned 0x20 [0037.845] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Tulips.jpg", cAlternateFileName="")) returned 0x5c8f40 [0037.845] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="Tulips.jpg", cAlternateFileName="")) returned 0 [0037.845] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0037.845] DeleteFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg")) returned 1 [0037.850] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg")) returned 0xffffffff [0037.850] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Tulips.jpg", cAlternateFileName="")) returned 0 [0037.850] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.851] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0037.851] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.851] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73657275, dwReserved1=0x2d797261, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1 [0037.851] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6a677067, dwReserved1=0x186770, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0037.851] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6a677067, dwReserved1=0x186770, cFileName="..", cAlternateFileName="")) returned 1 [0037.851] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x89e5e11e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x89e5e11e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x6a677067, dwReserved1=0x186770, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.851] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Recorded TV\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\desktop.ini")) returned 0x26 [0037.852] VirtualAlloc (lpAddress=0x33dc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33dc000 [0037.852] CreateFileA (lpFileName="C:\\Users\\Public\\Recorded TV\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0037.853] CreateFileA (lpFileName="C:\\Users\\Public\\Recorded TV\\desktop.ini.crypt" (normalized: "c:\\users\\public\\recorded tv\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.853] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x50, lpOverlapped=0x0) returned 1 [0037.854] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x50, lpOverlapped=0x0) returned 1 [0037.855] ReadFile (in: hFile=0xec, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.855] WriteFile (in: hFile=0xe8, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.855] CloseHandle (hObject=0xec) returned 1 [0037.855] CloseHandle (hObject=0xe8) returned 1 [0037.855] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Recorded TV\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Recorded TV\\desktop.ini.crypt" (normalized: "c:\\users\\public\\recorded tv\\desktop.ini.crypt")) returned 0 [0037.856] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Recorded TV\\desktop.ini.crypt" (normalized: "c:\\users\\public\\recorded tv\\desktop.ini.crypt")) returned 0x20 [0037.856] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Recorded TV\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x89e5e11e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x89e5e11e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f00 [0037.856] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x89e5e11e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x89e5e11e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.856] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.856] DeleteFileA (lpFileName="C:\\Users\\Public\\Recorded TV\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\desktop.ini")) returned 1 [0037.857] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Recorded TV\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\desktop.ini")) returned 0xffffffff [0037.857] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 1 [0037.857] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0037.857] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.857] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x4e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.857] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\sample media\\desktop.ini")) returned 0x26 [0037.857] CreateFileA (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\sample media\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0037.858] CreateFileA (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini.crypt" (normalized: "c:\\users\\public\\recorded tv\\sample media\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.863] ReadFile (in: hFile=0xec, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0xab, lpOverlapped=0x0) returned 1 [0037.864] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0xab, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0xab, lpOverlapped=0x0) returned 1 [0037.865] ReadFile (in: hFile=0xec, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.865] WriteFile (in: hFile=0xdc, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.865] CloseHandle (hObject=0xec) returned 1 [0037.865] CloseHandle (hObject=0xdc) returned 1 [0037.865] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\sample media\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini.crypt" (normalized: "c:\\users\\public\\recorded tv\\sample media\\desktop.ini.crypt")) returned 0 [0037.865] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini.crypt" (normalized: "c:\\users\\public\\recorded tv\\sample media\\desktop.ini.crypt")) returned 0x20 [0037.865] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0037.866] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.866] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0037.866] DeleteFileA (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\sample media\\desktop.ini")) returned 1 [0037.866] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\desktop.ini" (normalized: "c:\\users\\public\\recorded tv\\sample media\\desktop.ini")) returned 0xffffffff [0037.866] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 1 [0037.867] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 0 [0037.867] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.867] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18f60c, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 0 [0037.867] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.867] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73657261, dwReserved1=0x2d797261, cFileName="Videos", cAlternateFileName="")) returned 1 [0037.867] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d65642d, dwReserved1=0x6f68736f, cFileName=".", cAlternateFileName="")) returned 0x5c8f00 [0037.867] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d65642d, dwReserved1=0x6f68736f, cFileName="..", cAlternateFileName="")) returned 1 [0037.867] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x6d65642d, dwReserved1=0x6f68736f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.867] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini")) returned 0x26 [0037.867] CreateFileA (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.867] CreateFileA (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini.crypt" (normalized: "c:\\users\\public\\videos\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0037.867] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x17c, lpOverlapped=0x0) returned 1 [0037.868] WriteFile (in: hFile=0xdc, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x17c, lpOverlapped=0x0) returned 1 [0037.869] ReadFile (in: hFile=0xe8, lpBuffer=0x18d660, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18d660*, lpNumberOfBytesRead=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.869] WriteFile (in: hFile=0xdc, lpBuffer=0x18e660*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d3ac, lpOverlapped=0x0 | out: lpBuffer=0x18e660*, lpNumberOfBytesWritten=0x18d3ac*=0x0, lpOverlapped=0x0) returned 1 [0037.869] CloseHandle (hObject=0xe8) returned 1 [0037.869] CloseHandle (hObject=0xdc) returned 1 [0037.869] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Videos\\desktop.ini.crypt" (normalized: "c:\\users\\public\\videos\\desktop.ini.crypt")) returned 0 [0037.869] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini.crypt" (normalized: "c:\\users\\public\\videos\\desktop.ini.crypt")) returned 0x20 [0037.870] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Videos\\desktop.ini", lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8ec0 [0037.870] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f4fc | out: lpFindFileData=0x18f4fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x5f60d8, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.870] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.870] DeleteFileA (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini")) returned 1 [0037.871] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini")) returned 0xffffffff [0037.871] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0037.871] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0037.871] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x44, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.871] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x44, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0037.871] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\sample videos\\desktop.ini")) returned 0x26 [0037.871] VirtualAlloc (lpAddress=0x33e0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33e0000 [0037.872] CreateFileA (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\sample videos\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0037.872] CreateFileA (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini.crypt" (normalized: "c:\\users\\public\\videos\\sample videos\\desktop.ini.crypt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0037.872] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x146, lpOverlapped=0x0) returned 1 [0037.873] WriteFile (in: hFile=0xec, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x146, lpOverlapped=0x0) returned 1 [0037.874] ReadFile (in: hFile=0xe8, lpBuffer=0x18d3f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18d3f8*, lpNumberOfBytesRead=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.874] WriteFile (in: hFile=0xec, lpBuffer=0x18e3f8*, nNumberOfBytesToWrite=0x0, lpNumberOfBytesWritten=0x18d144, lpOverlapped=0x0 | out: lpBuffer=0x18e3f8*, lpNumberOfBytesWritten=0x18d144*=0x0, lpOverlapped=0x0) returned 1 [0037.874] CloseHandle (hObject=0xe8) returned 1 [0037.874] CloseHandle (hObject=0xec) returned 1 [0037.874] MoveFileA (lpExistingFileName="C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\sample videos\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini.crypt" (normalized: "c:\\users\\public\\videos\\sample videos\\desktop.ini.crypt")) returned 0 [0037.874] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini.crypt" (normalized: "c:\\users\\public\\videos\\sample videos\\desktop.ini.crypt")) returned 0x20 [0037.874] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini", lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0x5c8f40 [0037.874] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f294 | out: lpFindFileData=0x18f294*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x5f5eb0, dwReserved1=0x5a8a90, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0037.874] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0037.874] DeleteFileA (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\sample videos\\desktop.ini")) returned 1 [0037.875] GetFileAttributesA (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\sample videos\\desktop.ini")) returned 0xffffffff [0037.875] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 1 [0037.875] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x5c8d98, dwReserved1=0x18f3a4, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 0 [0037.875] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0037.875] FindNextFileA (in: hFindFile=0x5c8f00, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0037.876] FindClose (in: hFindFile=0x5c8f00 | out: hFindFile=0x5c8f00) returned 1 [0037.876] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73657261, dwReserved1=0x2d797261, cFileName="Videos", cAlternateFileName="")) returned 0 [0037.876] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0037.876] FindNextFileA (in: hFindFile=0x5c3c68, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18fadc, cFileName="Public", cAlternateFileName="")) returned 0 [0037.876] FindClose (in: hFindFile=0x5c3c68 | out: hFindFile=0x5c3c68) returned 1 [0037.876] FindFirstFileA (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6a53570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a53570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18fadc, cFileName=".", cAlternateFileName="")) returned 0x5c8e80 [0037.876] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6a53570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a53570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18fadc, cFileName="..", cAlternateFileName="")) returned 1 [0037.876] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa56afff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa56afff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c8d98, dwReserved1=0x18fadc, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0037.876] CryptAcquireContextA (in: phProv=0x18fb3c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18fb3c*=0x5d0e80) returned 1 [0038.051] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18faf4 | out: phHash=0x18faf4) returned 1 [0038.051] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.052] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18fb38 | out: phKey=0x18fb38*=0x5c8f40) returned 1 [0038.053] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0038.053] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18fb48*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18fb48) returned 0 [0038.054] GetLastError () returned 0xea [0038.054] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18fb44*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18fb44*=0x260) returned 1 [0038.055] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0038.056] WriteFile (in: hFile=0xf4, lpBuffer=0x33e25c4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f8c8, lpOverlapped=0x0 | out: lpBuffer=0x33e25c4*, lpNumberOfBytesWritten=0x18f8c8*=0x7a0, lpOverlapped=0x0) returned 1 [0038.057] SetEndOfFile (hFile=0xf4) returned 1 [0038.057] CloseHandle (hObject=0xf4) returned 1 [0038.058] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0038.058] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.058] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa72a8270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72a8270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0038.058] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa72a8270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72a8270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.058] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AppData", cAlternateFileName="")) returned 1 [0038.058] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0038.058] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0038.058] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.058] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8f80) returned 1 [0038.058] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0038.059] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1e78*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1e78, pdwDataLen=0x18f8e0) returned 0 [0038.059] GetLastError () returned 0xea [0038.059] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1e78*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1e78*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0038.059] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0038.059] WriteFile (in: hFile=0xdc, lpBuffer=0x33e1664*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33e1664*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0038.060] SetEndOfFile (hFile=0xdc) returned 1 [0038.061] CloseHandle (hObject=0xdc) returned 1 [0038.061] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0038.061] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.061] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0038.061] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.061] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa72ce3d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.061] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Local", cAlternateFileName="")) returned 1 [0038.061] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0038.062] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0038.062] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.062] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8fc0) returned 1 [0038.062] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0038.062] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e331c*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e331c, pdwDataLen=0x18f678) returned 0 [0038.062] GetLastError () returned 0xea [0038.062] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e331c*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e331c*, pdwDataLen=0x18f674*=0x260) returned 1 [0038.062] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0038.063] WriteFile (in: hFile=0xf8, lpBuffer=0x33e0e88*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33e0e88*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0038.063] SetEndOfFile (hFile=0xf8) returned 1 [0038.064] CloseHandle (hObject=0xf8) returned 1 [0038.064] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0038.064] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.064] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0038.064] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.064] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Adobe", cAlternateFileName="")) returned 1 [0038.064] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0038.064] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0038.064] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.064] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9000) returned 1 [0038.065] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0038.065] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e392c*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e392c, pdwDataLen=0x18f410) returned 0 [0038.065] GetLastError () returned 0xea [0038.065] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e392c*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e392c*, pdwDataLen=0x18f40c*=0x260) returned 1 [0038.065] VirtualAlloc (lpAddress=0x33e4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33e4000 [0038.065] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0038.066] WriteFile (in: hFile=0xec, lpBuffer=0x33e51dc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33e51dc*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0038.066] SetEndOfFile (hFile=0xec) returned 1 [0038.067] CloseHandle (hObject=0xec) returned 1 [0038.067] CryptDestroyKey (hKey=0x5c9000) returned 1 [0038.067] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.067] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0038.067] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.067] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0038.067] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0038.067] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0038.067] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.067] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0038.067] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0038.068] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e4a70*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e4a70, pdwDataLen=0x18f1a8) returned 0 [0038.068] GetLastError () returned 0xea [0038.068] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e4a70*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e4a70*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0038.068] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0038.068] WriteFile (in: hFile=0xe8, lpBuffer=0x33e57f4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33e57f4*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0038.069] SetEndOfFile (hFile=0xe8) returned 1 [0038.069] CloseHandle (hObject=0xe8) returned 1 [0038.069] CryptDestroyKey (hKey=0x5c9040) returned 1 [0038.069] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.069] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0038.070] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.070] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="10.0", cAlternateFileName="")) returned 1 [0038.070] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0038.070] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0038.070] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.070] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9080) returned 1 [0038.070] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0038.070] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e5810*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e5810, pdwDataLen=0x18ef40) returned 0 [0038.070] GetLastError () returned 0xea [0038.070] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e5810*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e5810*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0038.071] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0038.072] WriteFile (in: hFile=0xf0, lpBuffer=0x33e6c8c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33e6c8c*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.073] SetEndOfFile (hFile=0xf0) returned 1 [0038.073] CloseHandle (hObject=0xf0) returned 1 [0038.073] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.073] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.073] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.073] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.073] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0038.073] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0038.073] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Cache", cAlternateFileName="")) returned 1 [0038.073] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0038.074] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0038.074] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.074] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c90c0) returned 1 [0038.074] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0038.074] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e6d64*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e6d64, pdwDataLen=0x18ecd8) returned 0 [0038.074] GetLastError () returned 0xea [0038.074] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e6d64*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e6d64*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0038.074] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0038.075] WriteFile (in: hFile=0x108, lpBuffer=0x33e4a54*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33e4a54*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0038.075] SetEndOfFile (hFile=0x108) returned 1 [0038.076] CloseHandle (hObject=0x108) returned 1 [0038.076] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.076] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.076] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.076] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.076] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0038.076] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa72f4530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.076] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa72f4530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.076] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.076] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa72ce3d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.076] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0038.076] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0038.076] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0038.076] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.076] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa72ce3d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x746e6e69, dwReserved1=0x52434e73, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.076] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa72ce3d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x746e6e69, dwReserved1=0x52434e73, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.076] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0038.076] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Color", cAlternateFileName="")) returned 1 [0038.077] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0038.077] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0038.077] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.077] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9080) returned 1 [0038.077] CryptDestroyHash (hHash=0x5c9040) returned 1 [0038.077] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e4a5c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e4a5c, pdwDataLen=0x18f1a8) returned 0 [0038.077] GetLastError () returned 0xea [0038.077] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e4a5c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e4a5c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0038.077] VirtualAlloc (lpAddress=0x33e8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33e8000 [0038.078] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0038.078] WriteFile (in: hFile=0xe8, lpBuffer=0x33e918c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33e918c*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0038.079] SetEndOfFile (hFile=0xe8) returned 1 [0038.079] CloseHandle (hObject=0xe8) returned 1 [0038.079] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.079] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.079] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.080] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0038.080] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa72f4530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.080] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Profiles", cAlternateFileName="")) returned 1 [0038.080] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0038.080] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0038.080] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.080] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c90c0) returned 1 [0038.080] CryptDestroyHash (hHash=0x5c9040) returned 1 [0038.080] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e8a28*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e8a28, pdwDataLen=0x18ef40) returned 0 [0038.080] GetLastError () returned 0xea [0038.080] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e8a28*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e8a28*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0038.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0038.081] WriteFile (in: hFile=0xf0, lpBuffer=0x33e9b18*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33e9b18*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.082] SetEndOfFile (hFile=0xf0) returned 1 [0038.082] CloseHandle (hObject=0xf0) returned 1 [0038.082] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.082] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.082] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.082] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.082] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa72f4530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.082] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0038.082] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0038.082] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0 [0038.083] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.083] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Profiles", cAlternateFileName="")) returned 0 [0038.083] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.083] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa72ce3d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.083] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa72ce3d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.083] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0038.083] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52434e45, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0038.083] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0038.083] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0038.083] CryptHashData (hHash=0x5c9000, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.083] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9080) returned 1 [0038.083] CryptDestroyHash (hHash=0x5c9000) returned 1 [0038.084] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e9b40*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e9b40, pdwDataLen=0x18f410) returned 0 [0038.084] GetLastError () returned 0xea [0038.084] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e9b40*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e9b40*, pdwDataLen=0x18f40c*=0x260) returned 1 [0038.084] VirtualAlloc (lpAddress=0x33ec000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33ec000 [0038.084] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0038.084] WriteFile (in: hFile=0xec, lpBuffer=0x33eca44*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33eca44*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0038.084] SetEndOfFile (hFile=0xec) returned 1 [0038.085] CloseHandle (hObject=0xec) returned 1 [0038.085] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.085] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.085] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f3a4, ftLastWriteTime.dwHighDateTime=0x18f3a0, nFileSizeHigh=0x18f3e8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x8f\x5c")) returned 0xffffffff [0038.085] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="Apps", cAlternateFileName="")) returned 1 [0038.085] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0038.085] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0038.085] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.085] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9000) returned 1 [0038.085] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.085] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33eca94*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33eca94, pdwDataLen=0x18f410) returned 0 [0038.085] GetLastError () returned 0xea [0038.086] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33eca94*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33eca94*, pdwDataLen=0x18f40c*=0x260) returned 1 [0038.086] VirtualFree (lpAddress=0x33e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.086] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0038.086] WriteFile (in: hFile=0xec, lpBuffer=0x33edb84*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33edb84*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0038.087] SetEndOfFile (hFile=0xec) returned 1 [0038.087] CloseHandle (hObject=0xec) returned 1 [0038.088] VirtualFree (lpAddress=0x33e8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.088] CryptDestroyKey (hKey=0x5c9000) returned 1 [0038.088] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.088] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0038.088] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.088] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="2.0", cAlternateFileName="")) returned 1 [0038.088] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0038.089] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0038.089] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.089] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0038.089] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.089] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33edc10*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33edc10, pdwDataLen=0x18f1a8) returned 0 [0038.089] GetLastError () returned 0xea [0038.089] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33edc10*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33edc10*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0038.089] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0038.089] WriteFile (in: hFile=0xe8, lpBuffer=0x33e06d8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33e06d8*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0038.090] SetEndOfFile (hFile=0xe8) returned 1 [0038.090] CloseHandle (hObject=0xe8) returned 1 [0038.090] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.091] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.091] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.091] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.091] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Data", cAlternateFileName="")) returned 1 [0038.091] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0038.091] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0038.091] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.091] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0038.091] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.091] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33edbcc*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33edbcc, pdwDataLen=0x18ef40) returned 0 [0038.091] GetLastError () returned 0xea [0038.091] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33edbcc*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33edbcc*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0038.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0038.092] WriteFile (in: hFile=0xf0, lpBuffer=0x33ee180*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33ee180*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.093] SetEndOfFile (hFile=0xf0) returned 1 [0038.093] CloseHandle (hObject=0xf0) returned 1 [0038.093] CryptDestroyKey (hKey=0x5c9040) returned 1 [0038.093] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.093] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0038.093] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.094] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1 [0038.094] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0038.094] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0038.094] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.094] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0038.094] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.094] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33ee200*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33ee200, pdwDataLen=0x18ecd8) returned 0 [0038.094] GetLastError () returned 0xea [0038.094] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33ee200*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33ee200*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0038.095] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0038.095] WriteFile (in: hFile=0x108, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0038.096] SetEndOfFile (hFile=0x108) returned 1 [0038.096] CloseHandle (hObject=0x108) returned 1 [0038.096] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0038.096] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0038.096] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.096] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1 [0038.096] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0038.097] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0038.097] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.097] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0038.097] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.097] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33edbcc*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33edbcc, pdwDataLen=0x18ea70) returned 0 [0038.097] GetLastError () returned 0xea [0038.097] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33edbcc*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33edbcc*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0038.097] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.098] WriteFile (in: hFile=0x114, lpBuffer=0x33ede34*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33ede34*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.099] SetEndOfFile (hFile=0x114) returned 1 [0038.099] CloseHandle (hObject=0x114) returned 1 [0038.099] CryptDestroyKey (hKey=0x5c9100) returned 1 [0038.099] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.099] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0038.099] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.099] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0038.099] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0038.100] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0038.100] CryptHashData (hHash=0x5c9080, pbData=0x33ede34, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.100] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9140) returned 1 [0038.100] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.100] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33edbcc*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33edbcc, pdwDataLen=0x18e808) returned 0 [0038.100] GetLastError () returned 0xea [0038.100] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33edbcc*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33edbcc*, pdwDataLen=0x18e804*=0x260) returned 1 [0038.100] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0038.100] WriteFile (in: hFile=0x104, lpBuffer=0x33ede34*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33ede34*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0038.101] SetEndOfFile (hFile=0x104) returned 1 [0038.101] CloseHandle (hObject=0x104) returned 1 [0038.102] CryptDestroyKey (hKey=0x5c9140) returned 1 [0038.102] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.102] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0038.102] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.102] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Data", cAlternateFileName="")) returned 1 [0038.102] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0038.102] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0038.102] CryptHashData (hHash=0x5c9080, pbData=0x33ede34, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.102] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9180) returned 1 [0038.102] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.103] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33edbcc*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33edbcc, pdwDataLen=0x18e5a0) returned 0 [0038.103] GetLastError () returned 0xea [0038.103] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33edbcc*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33edbcc*, pdwDataLen=0x18e59c*=0x260) returned 1 [0038.103] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\data\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.103] WriteFile (in: hFile=0xfc, lpBuffer=0x33e15cc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33e15cc*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0038.104] SetEndOfFile (hFile=0xfc) returned 1 [0038.104] CloseHandle (hObject=0xfc) returned 1 [0038.104] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.104] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.104] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.105] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.105] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa731a690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.105] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa731a690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.105] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.105] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa731a690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.105] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa731a690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.105] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0038.105] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa731a690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.105] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa731a690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.105] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0038.105] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa731a690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.105] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa731a690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.105] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0038.105] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa731a690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.105] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa731a690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.105] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0038.105] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1 [0038.105] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0038.106] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0038.106] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.106] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0038.106] CryptDestroyHash (hHash=0x5c9040) returned 1 [0038.106] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0754*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e0754, pdwDataLen=0x18ef40) returned 0 [0038.106] GetLastError () returned 0xea [0038.106] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0754*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e0754*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0038.106] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0038.107] WriteFile (in: hFile=0xf0, lpBuffer=0x33e14f8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33e14f8*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.108] SetEndOfFile (hFile=0xf0) returned 1 [0038.108] CloseHandle (hObject=0xf0) returned 1 [0038.108] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0038.108] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.108] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0038.108] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.108] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73407f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.108] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1 [0038.108] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0038.109] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0038.109] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.109] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9100) returned 1 [0038.109] CryptDestroyHash (hHash=0x5c9040) returned 1 [0038.109] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33ee1c8*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33ee1c8, pdwDataLen=0x18ecd8) returned 0 [0038.109] GetLastError () returned 0xea [0038.109] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33ee1c8*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33ee1c8*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0038.109] VirtualAlloc (lpAddress=0x33f0000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x33f0000 [0038.109] VirtualAlloc (lpAddress=0x33f0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33f0000 [0038.109] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0038.110] WriteFile (in: hFile=0x108, lpBuffer=0x33f1274*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33f1274*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0038.111] SetEndOfFile (hFile=0x108) returned 1 [0038.111] CloseHandle (hObject=0x108) returned 1 [0038.111] CryptDestroyKey (hKey=0x5c9100) returned 1 [0038.111] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.111] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0038.111] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.111] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1 [0038.111] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0038.112] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0038.112] CryptHashData (hHash=0x5c9040, pbData=0x33f0d34, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.112] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9140) returned 1 [0038.112] CryptDestroyHash (hHash=0x5c9040) returned 1 [0038.112] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0acc*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f0acc, pdwDataLen=0x18ea70) returned 0 [0038.112] GetLastError () returned 0xea [0038.112] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0acc*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f0acc*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0038.112] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.114] WriteFile (in: hFile=0x114, lpBuffer=0x33f1ef8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33f1ef8*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.115] SetEndOfFile (hFile=0x114) returned 1 [0038.115] CloseHandle (hObject=0x114) returned 1 [0038.115] CryptDestroyKey (hKey=0x5c9140) returned 1 [0038.115] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0038.115] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.115] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0038.115] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73407f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.115] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73407f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.115] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0038.115] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0038.116] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0038.116] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0038.116] CryptHashData (hHash=0x5c9140, pbData=0x33f21f0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.116] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0038.116] CryptDestroyHash (hHash=0x5c9140) returned 1 [0038.116] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1f88*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f1f88, pdwDataLen=0x18ea70) returned 0 [0038.116] GetLastError () returned 0xea [0038.116] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1f88*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f1f88*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0038.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.118] WriteFile (in: hFile=0x114, lpBuffer=0x33f3828*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33f3828*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.118] SetEndOfFile (hFile=0x114) returned 1 [0038.119] CloseHandle (hObject=0x114) returned 1 [0038.119] CryptDestroyKey (hKey=0x5c9040) returned 1 [0038.119] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.119] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0038.119] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.119] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 1 [0038.119] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="clickonce_bootstrap.exe.cdf-ms", cAlternateFileName="")) returned 1 [0038.119] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="clickonce_bootstrap.exe.manifest", cAlternateFileName="")) returned 1 [0038.119] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="clickonce_bootstrap_unsigned.cdf-ms", cAlternateFileName="CLICKO~1.CDF")) returned 1 [0038.119] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="clickonce_bootstrap_unsigned.manifest", cAlternateFileName="CLICKO~1.MAN")) returned 1 [0038.119] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 1 [0038.119] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73407f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.119] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73407f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.119] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0038.119] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73407f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73407f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73407f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.119] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1 [0038.119] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0038.120] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0038.120] CryptHashData (hHash=0x5c9040, pbData=0x33f3318, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.120] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9140) returned 1 [0038.120] CryptDestroyHash (hHash=0x5c9040) returned 1 [0038.120] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f30b0*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f30b0, pdwDataLen=0x18ea70) returned 0 [0038.120] GetLastError () returned 0xea [0038.120] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f30b0*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f30b0*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0038.120] VirtualAlloc (lpAddress=0x33f4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x33f4000 [0038.121] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.122] WriteFile (in: hFile=0x114, lpBuffer=0x33f4950*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33f4950*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.123] SetEndOfFile (hFile=0x114) returned 1 [0038.123] CloseHandle (hObject=0x114) returned 1 [0038.123] CryptDestroyKey (hKey=0x5c9140) returned 1 [0038.123] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.123] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0038.123] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cAlternateFileName="CLICEX~1.MAN")) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", cAlternateFileName="GOOGAP~1.CDF")) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7366950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7366950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.123] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0 [0038.123] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0 [0038.123] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa731a690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20455254, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa731a690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa731a690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa731a690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20455254, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.123] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.124] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa72f4530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.124] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa72f4530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72f4530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72f4530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.124] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0038.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0038.124] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0038.124] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0038.124] CryptHashData (hHash=0x5c9000, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.124] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0038.124] CryptDestroyHash (hHash=0x5c9000) returned 1 [0038.124] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f02d0*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33f02d0, pdwDataLen=0x18f410) returned 0 [0038.124] GetLastError () returned 0xea [0038.124] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f02d0*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33f02d0*, pdwDataLen=0x18f40c*=0x260) returned 1 [0038.125] VirtualFree (lpAddress=0x33f4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.125] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\deployment\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0038.125] WriteFile (in: hFile=0xec, lpBuffer=0x33f1b70*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33f1b70*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0038.126] SetEndOfFile (hFile=0xec) returned 1 [0038.126] CloseHandle (hObject=0xec) returned 1 [0038.126] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.126] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.127] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.127] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7366950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.127] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7366950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.127] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.127] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1 [0038.127] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Google", cAlternateFileName="")) returned 1 [0038.127] VirtualFree (lpAddress=0x33ec000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0038.127] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0038.128] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0038.128] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.128] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9000) returned 1 [0038.128] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.128] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1428*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33f1428, pdwDataLen=0x18f410) returned 0 [0038.128] GetLastError () returned 0xea [0038.128] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1428*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33f1428*, pdwDataLen=0x18f40c*=0x260) returned 1 [0038.128] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0038.129] WriteFile (in: hFile=0xec, lpBuffer=0x33e0e88*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33e0e88*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0038.130] SetEndOfFile (hFile=0xec) returned 1 [0038.130] CloseHandle (hObject=0xec) returned 1 [0038.130] CryptDestroyKey (hKey=0x5c9000) returned 1 [0038.130] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.130] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0038.130] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.130] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Chrome", cAlternateFileName="")) returned 1 [0038.130] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0038.132] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0038.132] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.132] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0038.132] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.132] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18f1a8) returned 0 [0038.132] GetLastError () returned 0xea [0038.132] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0038.132] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0038.132] WriteFile (in: hFile=0xe8, lpBuffer=0x33e06d8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33e06d8*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0038.133] SetEndOfFile (hFile=0xe8) returned 1 [0038.133] CloseHandle (hObject=0xe8) returned 1 [0038.133] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0038.133] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.134] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0038.134] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.134] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7366950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.134] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0038.134] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0038.134] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0038.134] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.134] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0038.134] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.134] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33f004c, pdwDataLen=0x18ef40) returned 0 [0038.134] GetLastError () returned 0xea [0038.134] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33f004c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0038.135] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0038.135] WriteFile (in: hFile=0xf0, lpBuffer=0x33e06d8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33e06d8*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.136] SetEndOfFile (hFile=0xf0) returned 1 [0038.136] CloseHandle (hObject=0xf0) returned 1 [0038.136] CryptDestroyKey (hKey=0x5c9100) returned 1 [0038.136] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0038.136] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.136] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0038.136] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0038.137] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0038.137] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.137] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9140) returned 1 [0038.137] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.137] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f8c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33f2f8c, pdwDataLen=0x18ecd8) returned 0 [0038.137] GetLastError () returned 0xea [0038.137] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f8c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33f2f8c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0038.137] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0038.138] WriteFile (in: hFile=0x108, lpBuffer=0x33e0d1c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33e0d1c*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0038.139] SetEndOfFile (hFile=0x108) returned 1 [0038.139] CloseHandle (hObject=0x108) returned 1 [0038.139] CryptDestroyKey (hKey=0x5c9140) returned 1 [0038.139] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.139] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0038.139] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.139] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa738cab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.139] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa738cab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.139] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0038.139] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0038.139] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0038.140] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0038.140] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.140] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c90c0) returned 1 [0038.140] CryptDestroyHash (hHash=0x5c9140) returned 1 [0038.140] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22c8*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33f22c8, pdwDataLen=0x18ecd8) returned 0 [0038.140] GetLastError () returned 0xea [0038.140] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22c8*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33f22c8*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0038.140] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0038.141] WriteFile (in: hFile=0x108, lpBuffer=0x33f03a0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33f03a0*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0038.142] SetEndOfFile (hFile=0x108) returned 1 [0038.142] CloseHandle (hObject=0x108) returned 1 [0038.142] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.142] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.142] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.142] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.142] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa738cab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.142] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="metadata", cAlternateFileName="")) returned 1 [0038.142] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="reports", cAlternateFileName="")) returned 1 [0038.142] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0038.143] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0038.143] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.143] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0038.143] CryptDestroyHash (hHash=0x5c9140) returned 1 [0038.143] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f17bc, pdwDataLen=0x18ea70) returned 0 [0038.143] GetLastError () returned 0xea [0038.143] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f17bc*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0038.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\reports\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.144] WriteFile (in: hFile=0x114, lpBuffer=0x33f21d4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33f21d4*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.144] SetEndOfFile (hFile=0x114) returned 1 [0038.145] CloseHandle (hObject=0x114) returned 1 [0038.145] CryptDestroyKey (hKey=0x5c9040) returned 1 [0038.145] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.145] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0038.145] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.145] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa738cab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.145] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa738cab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.145] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0038.145] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0038.145] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0038.145] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.145] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20455274, dwReserved1=0x52434e45, cFileName="Default", cAlternateFileName="")) returned 1 [0038.145] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0038.146] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0038.146] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.146] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0038.146] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.146] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18ecd8) returned 0 [0038.146] GetLastError () returned 0xea [0038.146] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0038.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0038.147] WriteFile (in: hFile=0x108, lpBuffer=0x33f006c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33f006c*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0038.147] SetEndOfFile (hFile=0x108) returned 1 [0038.148] CloseHandle (hObject=0x108) returned 1 [0038.148] CryptDestroyKey (hKey=0x5c9040) returned 1 [0038.148] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.148] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0038.148] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.148] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Cache", cAlternateFileName="")) returned 1 [0038.148] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0038.149] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0038.149] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.149] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9140) returned 1 [0038.149] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.149] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0098*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f0098, pdwDataLen=0x18ea70) returned 0 [0038.149] GetLastError () returned 0xea [0038.149] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0098*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f0098*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0038.149] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.151] WriteFile (in: hFile=0x114, lpBuffer=0x33e1d10*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33e1d10*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.152] SetEndOfFile (hFile=0x114) returned 1 [0038.152] CloseHandle (hObject=0x114) returned 1 [0038.152] CryptDestroyKey (hKey=0x5c9140) returned 1 [0038.152] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.152] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0038.152] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.152] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="data_0", cAlternateFileName="")) returned 1 [0038.152] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="data_1", cAlternateFileName="")) returned 1 [0038.152] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="data_2", cAlternateFileName="")) returned 1 [0038.152] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0e3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x402000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="data_3", cAlternateFileName="")) returned 1 [0038.152] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa738cab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.152] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index", cAlternateFileName="")) returned 1 [0038.152] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x805aa0c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x805aa0c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x805aa0c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x80170, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index", cAlternateFileName="")) returned 0 [0038.152] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0038.152] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d406e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d406e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d1e730, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Cookies", cAlternateFileName="")) returned 1 [0038.153] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x98d44890, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Cookies-journal", cAlternateFileName="COOKIE~1")) returned 1 [0038.153] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83b08a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83b08a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0b57b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Current Session", cAlternateFileName="CURREN~1")) returned 1 [0038.153] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3b6860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3b6860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b8f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x126, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Current Tabs", cAlternateFileName="CURREN~2")) returned 1 [0038.153] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="data_reduction_proxy_leveldb", cAlternateFileName="DATA_R~1")) returned 1 [0038.153] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0038.153] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0038.153] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.153] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c90c0) returned 1 [0038.153] CryptDestroyHash (hHash=0x5c9140) returned 1 [0038.153] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18ea70) returned 0 [0038.153] GetLastError () returned 0xea [0038.153] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0038.154] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.155] WriteFile (in: hFile=0x114, lpBuffer=0x33e207c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33e207c*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.156] SetEndOfFile (hFile=0x114) returned 1 [0038.156] CloseHandle (hObject=0x114) returned 1 [0038.156] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.156] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.156] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.156] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.156] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80916060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80916060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80916060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="000003.log", cAlternateFileName="")) returned 1 [0038.156] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x804795c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0038.156] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73b2c10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.156] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LOCK", cAlternateFileName="")) returned 1 [0038.156] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9ab9e110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LOG", cAlternateFileName="")) returned 1 [0038.156] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0038.156] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802d66a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802d66a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x802d66a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0038.156] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.156] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82bed750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x52434e45, cFileName="Extension Rules", cAlternateFileName="EXTENS~3")) returned 1 [0038.156] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0038.157] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0038.157] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.157] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9140) returned 1 [0038.157] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.157] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18ea70) returned 0 [0038.157] GetLastError () returned 0xea [0038.157] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0038.157] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.158] WriteFile (in: hFile=0x114, lpBuffer=0x33f1b10*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33f1b10*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.159] SetEndOfFile (hFile=0x114) returned 1 [0038.159] CloseHandle (hObject=0x114) returned 1 [0038.159] CryptDestroyKey (hKey=0x5c9140) returned 1 [0038.159] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0038.159] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.160] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82bed750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82bed750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="000003.log", cAlternateFileName="")) returned 1 [0038.160] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82adc050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82adc050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0038.160] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73b2c10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.160] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ad9940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LOCK", cAlternateFileName="")) returned 1 [0038.160] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8dae37f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LOG", cAlternateFileName="")) returned 1 [0038.160] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0038.160] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82ad9940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82ad9940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82adc050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0038.160] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0038.160] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82556720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x52434e45, cFileName="Extension State", cAlternateFileName="EXTENS~2")) returned 1 [0038.160] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0038.160] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0038.160] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.160] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c90c0) returned 1 [0038.161] CryptDestroyHash (hHash=0x5c9140) returned 1 [0038.161] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18ea70) returned 0 [0038.161] GetLastError () returned 0xea [0038.161] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0038.161] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.162] WriteFile (in: hFile=0x114, lpBuffer=0x33f262c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33f262c*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.163] SetEndOfFile (hFile=0x114) returned 1 [0038.163] CloseHandle (hObject=0x114) returned 1 [0038.163] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.163] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.163] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.163] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.163] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82556720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82556720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4ad, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="000003.log", cAlternateFileName="")) returned 1 [0038.163] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824d3190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0038.163] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73b2c10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.163] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LOCK", cAlternateFileName="")) returned 1 [0038.163] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6f3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LOG", cAlternateFileName="")) returned 1 [0038.163] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0038.163] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824ad030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824ad030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x824ad030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0038.163] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.164] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31303030, dwReserved1=0x52434e45, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0038.164] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0038.164] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0038.164] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.164] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9140) returned 1 [0038.164] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.164] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18ea70) returned 0 [0038.164] GetLastError () returned 0xea [0038.164] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0038.165] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0038.165] WriteFile (in: hFile=0x114, lpBuffer=0x33e0a74*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33e0a74*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0038.166] SetEndOfFile (hFile=0x114) returned 1 [0038.166] CloseHandle (hObject=0x114) returned 1 [0038.166] CryptDestroyKey (hKey=0x5c9140) returned 1 [0038.166] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.167] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0038.167] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.167] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="aapocclcgogkmnckokdopfmhonfmgoek", cAlternateFileName="AAPOCC~1")) returned 1 [0038.167] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0038.167] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0038.167] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.167] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9180) returned 1 [0038.168] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.168] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e808) returned 0 [0038.168] GetLastError () returned 0xea [0038.168] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e804*=0x260) returned 1 [0038.168] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0038.168] WriteFile (in: hFile=0x104, lpBuffer=0x33e1d28*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33e1d28*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0038.169] SetEndOfFile (hFile=0x104) returned 1 [0038.169] CloseHandle (hObject=0x104) returned 1 [0038.169] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.169] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.169] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73d8d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73d8d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.169] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73d8d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73d8d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.169] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa21df7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa21df7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0038.169] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0038.170] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0038.170] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.170] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9080) returned 1 [0038.170] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.170] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e5a0) returned 0 [0038.170] GetLastError () returned 0xea [0038.170] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e59c*=0x260) returned 1 [0038.171] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.171] WriteFile (in: hFile=0xfc, lpBuffer=0x33e2094*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33e2094*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0038.172] SetEndOfFile (hFile=0xfc) returned 1 [0038.174] CloseHandle (hObject=0xfc) returned 1 [0038.174] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.174] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73d8d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73d8d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.174] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73d8d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73d8d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.174] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73d8d70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73d8d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73d8d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.174] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa21b9670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa21b9670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa21b9670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="icon_128.png.crypt", cAlternateFileName="ICON_1~1.CRY")) returned 1 [0038.174] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa21df7d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa21df7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa21df7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="icon_16.png.crypt", cAlternateFileName="ICON_1~2.CRY")) returned 1 [0038.174] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b74730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0038.174] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="main.js", cAlternateFileName="")) returned 1 [0038.175] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0038.175] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_locales", cAlternateFileName="")) returned 1 [0038.175] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0038.175] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0038.175] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.175] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c91c0) returned 1 [0038.175] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.175] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e338) returned 0 [0038.175] GetLastError () returned 0xea [0038.175] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e334*=0x260) returned 1 [0038.176] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.177] WriteFile (in: hFile=0x100, lpBuffer=0x33f2df0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33f2df0*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0038.177] SetEndOfFile (hFile=0x100) returned 1 [0038.178] CloseHandle (hObject=0x100) returned 1 [0038.178] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0038.178] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.178] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73d8d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73d8d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0038.178] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73d8d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73d8d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.178] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ar", cAlternateFileName="")) returned 1 [0038.178] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.178] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.178] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.179] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.179] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.179] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0710*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0710, pdwDataLen=0x18e0d0) returned 0 [0038.179] GetLastError () returned 0xea [0038.179] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0710*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0710*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.179] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.179] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03c4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03c4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.180] SetEndOfFile (hFile=0x10c) returned 1 [0038.180] CloseHandle (hObject=0x10c) returned 1 [0038.180] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.180] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73d8d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73d8d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.181] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73d8d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73d8d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.181] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73d8d70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73d8d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73d8d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.181] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.181] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.181] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.181] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="bg", cAlternateFileName="")) returned 1 [0038.181] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.182] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.182] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.182] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.182] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.182] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0710*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0710, pdwDataLen=0x18e0d0) returned 0 [0038.182] GetLastError () returned 0xea [0038.182] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0710*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0710*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.183] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03b4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03b4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.184] SetEndOfFile (hFile=0x10c) returned 1 [0038.184] CloseHandle (hObject=0x10c) returned 1 [0038.184] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.184] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.184] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.184] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.184] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73feed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.184] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.184] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.184] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.184] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ca", cAlternateFileName="")) returned 1 [0038.184] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.185] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.185] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.185] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.185] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.185] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f29f4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f29f4, pdwDataLen=0x18e0d0) returned 0 [0038.185] GetLastError () returned 0xea [0038.185] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f29f4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f29f4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.185] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.186] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0eb8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0eb8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.187] SetEndOfFile (hFile=0x10c) returned 1 [0038.187] CloseHandle (hObject=0x10c) returned 1 [0038.187] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.187] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.187] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.188] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.188] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73feed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.188] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.188] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.188] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.188] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="cs", cAlternateFileName="")) returned 1 [0038.188] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.188] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.188] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.188] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.188] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.188] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f29e4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f29e4, pdwDataLen=0x18e0d0) returned 0 [0038.188] GetLastError () returned 0xea [0038.189] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f29e4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f29e4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.189] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.189] WriteFile (in: hFile=0x10c, lpBuffer=0x33e19d4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e19d4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.190] SetEndOfFile (hFile=0x10c) returned 1 [0038.190] CloseHandle (hObject=0x10c) returned 1 [0038.190] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.190] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.190] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.190] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.190] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73feed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.191] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.191] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.191] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.191] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="da", cAlternateFileName="")) returned 1 [0038.191] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.191] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.191] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.191] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.191] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.191] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17c0, pdwDataLen=0x18e0d0) returned 0 [0038.191] GetLastError () returned 0xea [0038.191] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.192] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.193] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d40*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d40*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.194] SetEndOfFile (hFile=0x10c) returned 1 [0038.194] CloseHandle (hObject=0x10c) returned 1 [0038.194] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.194] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.194] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.194] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.194] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73feed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.194] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.194] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.194] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.194] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="de", cAlternateFileName="")) returned 1 [0038.194] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.195] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.195] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.195] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.195] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.195] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a50*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1a50, pdwDataLen=0x18e0d0) returned 0 [0038.195] GetLastError () returned 0xea [0038.195] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a50*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1a50*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.195] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.196] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03e4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03e4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.196] SetEndOfFile (hFile=0x10c) returned 1 [0038.197] CloseHandle (hObject=0x10c) returned 1 [0038.197] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.197] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.197] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73feed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73feed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73feed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.197] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.197] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="el", cAlternateFileName="")) returned 1 [0038.197] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.198] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.198] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.198] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.198] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.198] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1d58*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1d58, pdwDataLen=0x18e0d0) returned 0 [0038.198] GetLastError () returned 0xea [0038.198] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1d58*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1d58*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.198] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.199] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2908*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2908*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.200] SetEndOfFile (hFile=0x10c) returned 1 [0038.200] CloseHandle (hObject=0x10c) returned 1 [0038.200] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.200] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.201] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.201] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7425030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.201] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.201] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.201] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.201] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en_GB", cAlternateFileName="")) returned 1 [0038.201] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.201] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.201] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.201] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.201] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.201] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e120c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e120c, pdwDataLen=0x18e0d0) returned 0 [0038.201] GetLastError () returned 0xea [0038.202] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e120c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e120c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.202] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.202] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03e4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03e4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.203] SetEndOfFile (hFile=0x10c) returned 1 [0038.203] CloseHandle (hObject=0x10c) returned 1 [0038.203] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.203] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.203] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.203] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.203] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7425030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.203] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.204] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.204] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.204] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en_US", cAlternateFileName="")) returned 1 [0038.204] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.204] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.204] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.204] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.204] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.204] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2508*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2508, pdwDataLen=0x18e0d0) returned 0 [0038.204] GetLastError () returned 0xea [0038.204] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2508*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2508*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.205] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.206] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2f20*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2f20*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.207] SetEndOfFile (hFile=0x10c) returned 1 [0038.207] CloseHandle (hObject=0x10c) returned 1 [0038.207] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.207] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.207] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.207] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.207] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7425030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.207] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.207] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.207] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.207] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es", cAlternateFileName="")) returned 1 [0038.207] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.208] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.208] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.208] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.208] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.208] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17c0, pdwDataLen=0x18e0d0) returned 0 [0038.208] GetLastError () returned 0xea [0038.208] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.208] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.209] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2100*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2100*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.209] SetEndOfFile (hFile=0x10c) returned 1 [0038.210] CloseHandle (hObject=0x10c) returned 1 [0038.210] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.210] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.210] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.210] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.210] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7425030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.210] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.210] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.210] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.210] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es_419", cAlternateFileName="")) returned 1 [0038.210] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.211] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.211] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.211] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.211] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.211] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0098*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0098, pdwDataLen=0x18e0d0) returned 0 [0038.211] GetLastError () returned 0xea [0038.211] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0098*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0098*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.211] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.212] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2018*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2018*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.213] SetEndOfFile (hFile=0x10c) returned 1 [0038.213] CloseHandle (hObject=0x10c) returned 1 [0038.213] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.213] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.213] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.214] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7425030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.214] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7425030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7425030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa744b190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.214] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.214] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.214] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.214] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="et", cAlternateFileName="")) returned 1 [0038.214] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.214] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.214] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.214] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.214] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.215] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.215] GetLastError () returned 0xea [0038.215] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.215] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2610*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2610*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.216] SetEndOfFile (hFile=0x10c) returned 1 [0038.216] CloseHandle (hObject=0x10c) returned 1 [0038.216] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.216] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.216] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa744b190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa744b190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.217] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa744b190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa744b190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.217] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa744b190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa744b190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa744b190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.217] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.217] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.217] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.217] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fi", cAlternateFileName="")) returned 1 [0038.217] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.217] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.217] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.217] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.217] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.217] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e18b4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e18b4, pdwDataLen=0x18e0d0) returned 0 [0038.217] GetLastError () returned 0xea [0038.218] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e18b4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e18b4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.218] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.219] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0708*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0708*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.220] SetEndOfFile (hFile=0x10c) returned 1 [0038.220] CloseHandle (hObject=0x10c) returned 1 [0038.220] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.220] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.220] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa744b190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa744b190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.220] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa744b190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa744b190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.220] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa744b190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa744b190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa744b190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.220] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.220] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.220] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.220] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fil", cAlternateFileName="")) returned 1 [0038.220] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.221] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.221] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.221] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.221] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.221] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0720, pdwDataLen=0x18e0d0) returned 0 [0038.221] GetLastError () returned 0xea [0038.221] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0720*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.221] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.222] WriteFile (in: hFile=0x10c, lpBuffer=0x33f297c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f297c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.223] SetEndOfFile (hFile=0x10c) returned 1 [0038.223] CloseHandle (hObject=0x10c) returned 1 [0038.223] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.223] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.223] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa744b190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa744b190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.223] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa744b190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa744b190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.223] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa744b190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa744b190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa744b190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.223] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.223] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.223] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.223] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fr", cAlternateFileName="")) returned 1 [0038.223] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.224] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.224] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.224] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.224] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.224] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17d0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17d0, pdwDataLen=0x18e0d0) returned 0 [0038.224] GetLastError () returned 0xea [0038.224] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17d0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17d0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.224] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.226] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.227] SetEndOfFile (hFile=0x10c) returned 1 [0038.227] CloseHandle (hObject=0x10c) returned 1 [0038.227] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.227] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa744b190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa744b190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.227] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa744b190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa744b190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.227] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa744b190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa744b190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa744b190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.227] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.227] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.227] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.227] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="he", cAlternateFileName="")) returned 1 [0038.227] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.228] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.228] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.228] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.228] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.228] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17c0, pdwDataLen=0x18e0d0) returned 0 [0038.228] GetLastError () returned 0xea [0038.228] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.229] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1d74*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1d74*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.230] SetEndOfFile (hFile=0x10c) returned 1 [0038.230] CloseHandle (hObject=0x10c) returned 1 [0038.230] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.230] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.230] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.230] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.230] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa744b190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa744b190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.230] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.230] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.230] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.230] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hi", cAlternateFileName="")) returned 1 [0038.230] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.231] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.231] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.231] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.231] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.231] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0e18*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0e18, pdwDataLen=0x18e0d0) returned 0 [0038.231] GetLastError () returned 0xea [0038.231] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0e18*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0e18*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.231] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.232] WriteFile (in: hFile=0x10c, lpBuffer=0x33f23e8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f23e8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.233] SetEndOfFile (hFile=0x10c) returned 1 [0038.233] CloseHandle (hObject=0x10c) returned 1 [0038.233] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.233] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.233] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.234] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.234] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa74712f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.234] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.234] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.234] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.234] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73d8d70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73d8d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73d8d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.234] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hu", cAlternateFileName="")) returned 1 [0038.234] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.234] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.234] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.234] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.234] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.234] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1bb4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1bb4, pdwDataLen=0x18e0d0) returned 0 [0038.234] GetLastError () returned 0xea [0038.235] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1bb4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1bb4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.235] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2640*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2640*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.236] SetEndOfFile (hFile=0x10c) returned 1 [0038.236] CloseHandle (hObject=0x10c) returned 1 [0038.236] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.236] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.236] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.237] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.237] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa74712f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.237] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.237] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.237] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.237] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="id", cAlternateFileName="")) returned 1 [0038.237] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.237] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.237] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.237] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.237] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.237] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0730*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0730, pdwDataLen=0x18e0d0) returned 0 [0038.237] GetLastError () returned 0xea [0038.237] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0730*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0730*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.238] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.239] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0cf4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0cf4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.240] SetEndOfFile (hFile=0x10c) returned 1 [0038.240] CloseHandle (hObject=0x10c) returned 1 [0038.240] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.240] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.240] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.240] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.240] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa74712f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.240] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.240] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.240] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.240] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="it", cAlternateFileName="")) returned 1 [0038.240] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.241] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.241] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.241] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.241] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.241] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f29a4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f29a4, pdwDataLen=0x18e0d0) returned 0 [0038.241] GetLastError () returned 0xea [0038.241] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f29a4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f29a4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.241] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.242] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1e54*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1e54*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.243] SetEndOfFile (hFile=0x10c) returned 1 [0038.243] CloseHandle (hObject=0x10c) returned 1 [0038.243] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.243] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.243] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.243] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.243] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa74712f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa74712f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74712f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.243] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.243] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.243] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.243] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ja", cAlternateFileName="")) returned 1 [0038.243] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.244] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.244] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.244] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.244] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.244] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1800*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1800, pdwDataLen=0x18e0d0) returned 0 [0038.244] GetLastError () returned 0xea [0038.244] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1800*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1800*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.245] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.246] WriteFile (in: hFile=0x10c, lpBuffer=0x33e19b4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e19b4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.247] SetEndOfFile (hFile=0x10c) returned 1 [0038.247] CloseHandle (hObject=0x10c) returned 1 [0038.247] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.248] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.248] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.248] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.248] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7497450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.248] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.248] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.248] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.248] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ko", cAlternateFileName="")) returned 1 [0038.248] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.249] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.249] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.249] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.249] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.249] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e120c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e120c, pdwDataLen=0x18e0d0) returned 0 [0038.249] GetLastError () returned 0xea [0038.249] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e120c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e120c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.249] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.249] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2754*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2754*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.250] SetEndOfFile (hFile=0x10c) returned 1 [0038.250] CloseHandle (hObject=0x10c) returned 1 [0038.250] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.251] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.251] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.251] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7497450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.251] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.251] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.251] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.251] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lt", cAlternateFileName="")) returned 1 [0038.251] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.252] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.252] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.252] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.252] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.252] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f277c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f277c, pdwDataLen=0x18e0d0) returned 0 [0038.252] GetLastError () returned 0xea [0038.252] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f277c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f277c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.253] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.254] SetEndOfFile (hFile=0x10c) returned 1 [0038.254] CloseHandle (hObject=0x10c) returned 1 [0038.254] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.254] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.254] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.254] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.254] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7497450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.255] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.255] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.255] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.255] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lv", cAlternateFileName="")) returned 1 [0038.255] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.255] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.255] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.255] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.255] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.255] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17c0, pdwDataLen=0x18e0d0) returned 0 [0038.255] GetLastError () returned 0xea [0038.255] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.256] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.256] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.257] SetEndOfFile (hFile=0x10c) returned 1 [0038.257] CloseHandle (hObject=0x10c) returned 1 [0038.257] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.257] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.257] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.258] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.258] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7497450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.258] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.258] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.258] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.258] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ms", cAlternateFileName="")) returned 1 [0038.258] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.258] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.258] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.258] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.258] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.258] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17c0, pdwDataLen=0x18e0d0) returned 0 [0038.258] GetLastError () returned 0xea [0038.258] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.259] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.260] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1d84*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1d84*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.261] SetEndOfFile (hFile=0x10c) returned 1 [0038.261] CloseHandle (hObject=0x10c) returned 1 [0038.261] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.261] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.261] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.261] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7497450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.261] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7497450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7497450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74bd5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.261] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.261] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.261] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.261] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="nl", cAlternateFileName="")) returned 1 [0038.261] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.262] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.262] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.262] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.262] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.262] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0e58*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0e58, pdwDataLen=0x18e0d0) returned 0 [0038.262] GetLastError () returned 0xea [0038.262] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0e58*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0e58*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.262] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.263] WriteFile (in: hFile=0x10c, lpBuffer=0x33f241c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f241c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.264] SetEndOfFile (hFile=0x10c) returned 1 [0038.264] CloseHandle (hObject=0x10c) returned 1 [0038.264] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.264] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.264] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74bd5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74bd5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.264] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74bd5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74bd5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.264] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa74bd5b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa74bd5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74bd5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.264] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.264] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.264] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.264] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="no", cAlternateFileName="")) returned 1 [0038.264] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.265] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.265] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.265] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.265] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.265] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f20e8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f20e8, pdwDataLen=0x18e0d0) returned 0 [0038.265] GetLastError () returned 0xea [0038.265] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f20e8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f20e8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.265] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.267] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2350*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2350*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.267] SetEndOfFile (hFile=0x10c) returned 1 [0038.268] CloseHandle (hObject=0x10c) returned 1 [0038.268] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.268] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.268] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74bd5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74bd5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.268] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74bd5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74bd5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.268] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa74bd5b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa74bd5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74bd5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.268] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.268] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.268] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.268] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pl", cAlternateFileName="")) returned 1 [0038.268] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.269] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.269] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.269] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.269] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.269] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e229c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e229c, pdwDataLen=0x18e0d0) returned 0 [0038.269] GetLastError () returned 0xea [0038.269] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e229c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e229c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.269] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.270] WriteFile (in: hFile=0x10c, lpBuffer=0x33f26ac*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f26ac*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.270] SetEndOfFile (hFile=0x10c) returned 1 [0038.270] CloseHandle (hObject=0x10c) returned 1 [0038.271] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.271] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.271] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74bd5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74bd5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.271] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74bd5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74bd5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.271] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa74bd5b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa74bd5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74bd5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.271] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.271] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.271] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.271] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0038.271] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.272] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.272] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.272] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.272] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.272] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0a94*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0a94, pdwDataLen=0x18e0d0) returned 0 [0038.272] GetLastError () returned 0xea [0038.272] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0a94*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0a94*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.272] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.273] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2e8c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2e8c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.274] SetEndOfFile (hFile=0x10c) returned 1 [0038.274] CloseHandle (hObject=0x10c) returned 1 [0038.274] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.274] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.274] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74bd5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74bd5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.274] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74bd5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74bd5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.274] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa74bd5b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa74bd5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74bd5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.274] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.274] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.274] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.274] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0038.275] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.275] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.275] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.275] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.275] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.275] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0710*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0710, pdwDataLen=0x18e0d0) returned 0 [0038.275] GetLastError () returned 0xea [0038.275] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0710*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0710*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.276] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.276] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2a84*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2a84*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.277] SetEndOfFile (hFile=0x10c) returned 1 [0038.277] CloseHandle (hObject=0x10c) returned 1 [0038.277] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.277] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.277] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.277] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.277] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa74e3710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.277] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.278] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.278] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.278] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ro", cAlternateFileName="")) returned 1 [0038.278] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.278] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.278] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.278] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.278] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.278] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22dc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f22dc, pdwDataLen=0x18e0d0) returned 0 [0038.278] GetLastError () returned 0xea [0038.278] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22dc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f22dc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.279] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.280] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1560*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1560*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.281] SetEndOfFile (hFile=0x10c) returned 1 [0038.281] CloseHandle (hObject=0x10c) returned 1 [0038.281] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.281] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.281] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.281] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.281] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa74e3710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.281] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.281] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.281] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.281] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ru", cAlternateFileName="")) returned 1 [0038.281] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.282] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.282] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.282] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.282] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.282] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17d0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17d0, pdwDataLen=0x18e0d0) returned 0 [0038.282] GetLastError () returned 0xea [0038.282] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17d0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17d0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.282] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.283] WriteFile (in: hFile=0x10c, lpBuffer=0x33e205c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e205c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.283] SetEndOfFile (hFile=0x10c) returned 1 [0038.284] CloseHandle (hObject=0x10c) returned 1 [0038.284] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.284] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.284] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.284] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.284] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa74e3710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.284] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.284] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.284] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.284] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sk", cAlternateFileName="")) returned 1 [0038.284] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.285] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.285] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.285] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.285] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.285] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0070*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0070, pdwDataLen=0x18e0d0) returned 0 [0038.285] GetLastError () returned 0xea [0038.285] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0070*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0070*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.285] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.286] WriteFile (in: hFile=0x10c, lpBuffer=0x33e19d4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e19d4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.287] SetEndOfFile (hFile=0x10c) returned 1 [0038.287] CloseHandle (hObject=0x10c) returned 1 [0038.287] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.287] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.287] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.287] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.287] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa74e3710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.288] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.288] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.288] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.288] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sl", cAlternateFileName="")) returned 1 [0038.288] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.288] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.288] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.288] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.288] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.288] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.288] GetLastError () returned 0xea [0038.288] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.289] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.289] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2640*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2640*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.290] SetEndOfFile (hFile=0x10c) returned 1 [0038.290] CloseHandle (hObject=0x10c) returned 1 [0038.290] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.290] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.290] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.290] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.290] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa74e3710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa74e3710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa74e3710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.290] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.290] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.291] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.291] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sr", cAlternateFileName="")) returned 1 [0038.291] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.291] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.291] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.291] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.291] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.291] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0730*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0730, pdwDataLen=0x18e0d0) returned 0 [0038.291] GetLastError () returned 0xea [0038.291] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0730*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0730*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.292] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.293] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03b4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03b4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.293] SetEndOfFile (hFile=0x10c) returned 1 [0038.294] CloseHandle (hObject=0x10c) returned 1 [0038.294] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.294] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.294] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.294] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.294] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7509870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.294] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.294] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.294] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.294] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sv", cAlternateFileName="")) returned 1 [0038.294] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.295] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.295] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.295] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.295] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.295] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0720, pdwDataLen=0x18e0d0) returned 0 [0038.295] GetLastError () returned 0xea [0038.295] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0720*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.295] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.296] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1358*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1358*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.297] SetEndOfFile (hFile=0x10c) returned 1 [0038.297] CloseHandle (hObject=0x10c) returned 1 [0038.297] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.297] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.297] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.297] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.297] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7509870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.297] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.297] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.297] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.297] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="th", cAlternateFileName="")) returned 1 [0038.297] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.298] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.298] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.298] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.298] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.298] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17f0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17f0, pdwDataLen=0x18e0d0) returned 0 [0038.298] GetLastError () returned 0xea [0038.298] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17f0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17f0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.298] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.299] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1868*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1868*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.300] SetEndOfFile (hFile=0x10c) returned 1 [0038.300] CloseHandle (hObject=0x10c) returned 1 [0038.300] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.300] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.300] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.301] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.301] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7509870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.301] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.301] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.301] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.301] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="tr", cAlternateFileName="")) returned 1 [0038.301] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.301] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.301] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.301] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.301] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.302] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17c0, pdwDataLen=0x18e0d0) returned 0 [0038.302] GetLastError () returned 0xea [0038.302] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.302] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.302] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1be4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1be4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.303] SetEndOfFile (hFile=0x10c) returned 1 [0038.303] CloseHandle (hObject=0x10c) returned 1 [0038.303] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.303] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.303] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.304] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.304] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7509870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.304] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.304] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.304] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.304] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="uk", cAlternateFileName="")) returned 1 [0038.304] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.304] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.304] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.304] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.305] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.305] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0080*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0080, pdwDataLen=0x18e0d0) returned 0 [0038.305] GetLastError () returned 0xea [0038.305] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0080*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0080*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.305] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.306] WriteFile (in: hFile=0x10c, lpBuffer=0x33f207c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f207c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.307] SetEndOfFile (hFile=0x10c) returned 1 [0038.307] CloseHandle (hObject=0x10c) returned 1 [0038.307] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.307] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.308] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7509870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.308] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7509870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7509870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa752f9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.308] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.308] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.308] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.308] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="vi", cAlternateFileName="")) returned 1 [0038.308] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.309] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.309] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.309] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.309] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.309] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0070*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0070, pdwDataLen=0x18e0d0) returned 0 [0038.309] GetLastError () returned 0xea [0038.309] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0070*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0070*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.309] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.309] WriteFile (in: hFile=0x10c, lpBuffer=0x33f02d8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f02d8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.310] SetEndOfFile (hFile=0x10c) returned 1 [0038.310] CloseHandle (hObject=0x10c) returned 1 [0038.311] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.311] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.311] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa752f9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa752f9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.311] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa752f9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa752f9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.311] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa752f9d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa752f9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa752f9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.311] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.311] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.311] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.311] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0038.311] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.312] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.312] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.312] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.312] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.312] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.312] GetLastError () returned 0xea [0038.312] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.312] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.313] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1b24*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1b24*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.314] SetEndOfFile (hFile=0x10c) returned 1 [0038.314] CloseHandle (hObject=0x10c) returned 1 [0038.314] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.314] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.314] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa752f9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa752f9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.314] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa752f9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa752f9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.314] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa752f9d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa752f9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa752f9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.314] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.314] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.314] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.315] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0038.315] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.315] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.315] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.315] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.315] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.315] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.315] GetLastError () returned 0xea [0038.315] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.316] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.316] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1b14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1b14*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.317] SetEndOfFile (hFile=0x10c) returned 1 [0038.317] CloseHandle (hObject=0x10c) returned 1 [0038.317] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.317] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.317] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa752f9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa752f9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.317] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa752f9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa752f9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.317] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa752f9d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa752f9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa752f9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.317] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.317] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.317] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.317] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0038.317] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0038.318] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0038.318] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0038.318] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0038.318] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.318] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c90c0) returned 1 [0038.318] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0038.318] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1288*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33e1288, pdwDataLen=0x18e338) returned 0 [0038.318] GetLastError () returned 0xea [0038.318] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1288*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33e1288*, pdwDataLen=0x18e334*=0x260) returned 1 [0038.319] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.321] WriteFile (in: hFile=0x100, lpBuffer=0x33f2df0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33f2df0*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0038.322] SetEndOfFile (hFile=0x100) returned 1 [0038.322] CloseHandle (hObject=0x100) returned 1 [0038.322] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.322] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.322] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa752f9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa752f9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.322] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa752f9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa752f9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.322] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85d166b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0038.322] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa752f9d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa752f9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa752f9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.322] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0038.322] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b9b830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0038.322] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.322] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0038.322] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.322] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73d8d70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73d8d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73d8d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x79726e6f, dwReserved1=0x52747470, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.323] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73d8d70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73d8d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73d8d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x79726e6f, dwReserved1=0x52747470, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.323] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.323] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="aohghmighlieiainnegkcijnfilokake", cAlternateFileName="AOHGHM~1")) returned 1 [0038.323] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0038.323] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0038.323] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.323] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9080) returned 1 [0038.323] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.323] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e808) returned 0 [0038.323] GetLastError () returned 0xea [0038.323] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e804*=0x260) returned 1 [0038.324] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0038.324] WriteFile (in: hFile=0x104, lpBuffer=0x33e1b38*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33e1b38*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0038.325] SetEndOfFile (hFile=0x104) returned 1 [0038.325] CloseHandle (hObject=0x104) returned 1 [0038.325] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.325] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.325] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7555b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7555b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.325] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7555b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7555b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.325] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa229deb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa229deb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0038.325] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0038.326] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0038.326] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.326] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c90c0) returned 1 [0038.326] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.326] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f29ec*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33f29ec, pdwDataLen=0x18e5a0) returned 0 [0038.326] GetLastError () returned 0xea [0038.326] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f29ec*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33f29ec*, pdwDataLen=0x18e59c*=0x260) returned 1 [0038.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.329] WriteFile (in: hFile=0xfc, lpBuffer=0x33e1d28*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33e1d28*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0038.330] SetEndOfFile (hFile=0xfc) returned 1 [0038.332] CloseHandle (hObject=0xfc) returned 1 [0038.332] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.332] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.332] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7555b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7555b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.333] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7555b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7555b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.333] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7555b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7555b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7555b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.333] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2277d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2277d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2277d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="icon_128.png.crypt", cAlternateFileName="ICON_1~1.CRY")) returned 1 [0038.333] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2277d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2277d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa229deb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="icon_16.png.crypt", cAlternateFileName="ICON_1~2.CRY")) returned 1 [0038.333] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0038.333] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x5b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="main.js", cAlternateFileName="")) returned 1 [0038.333] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0038.333] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_locales", cAlternateFileName="")) returned 1 [0038.333] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0038.333] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0038.333] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.333] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c91c0) returned 1 [0038.333] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.334] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17f0*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f17f0, pdwDataLen=0x18e338) returned 0 [0038.334] GetLastError () returned 0xea [0038.334] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17f0*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f17f0*, pdwDataLen=0x18e334*=0x260) returned 1 [0038.334] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.335] WriteFile (in: hFile=0x100, lpBuffer=0x33f2554*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33f2554*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0038.336] SetEndOfFile (hFile=0x100) returned 1 [0038.336] CloseHandle (hObject=0x100) returned 1 [0038.336] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0038.336] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.336] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7555b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7555b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0038.336] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7555b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7555b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.336] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ar", cAlternateFileName="")) returned 1 [0038.336] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.337] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.337] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.337] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.337] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.337] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1dac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1dac, pdwDataLen=0x18e0d0) returned 0 [0038.337] GetLastError () returned 0xea [0038.337] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1dac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1dac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.337] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.339] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2014*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2014*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.339] SetEndOfFile (hFile=0x10c) returned 1 [0038.340] CloseHandle (hObject=0x10c) returned 1 [0038.340] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.340] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.340] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa757bc90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa757bc90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.340] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa757bc90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa757bc90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.340] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa757bc90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa757bc90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa757bc90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.340] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.340] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.340] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.340] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="bg", cAlternateFileName="")) returned 1 [0038.340] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.341] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.341] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.341] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.341] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.341] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17d8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17d8, pdwDataLen=0x18e0d0) returned 0 [0038.341] GetLastError () returned 0xea [0038.341] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17d8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17d8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.341] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.342] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2118*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2118*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.342] SetEndOfFile (hFile=0x10c) returned 1 [0038.342] CloseHandle (hObject=0x10c) returned 1 [0038.343] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.343] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.343] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa757bc90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa757bc90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.343] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa757bc90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa757bc90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.343] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa757bc90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa757bc90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa757bc90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.343] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.343] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.343] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.343] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ca", cAlternateFileName="")) returned 1 [0038.343] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.344] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.344] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.344] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.344] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.344] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0aa4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0aa4, pdwDataLen=0x18e0d0) returned 0 [0038.344] GetLastError () returned 0xea [0038.344] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0aa4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0aa4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.344] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.345] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1fb8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1fb8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.351] SetEndOfFile (hFile=0x10c) returned 1 [0038.352] CloseHandle (hObject=0x10c) returned 1 [0038.352] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.352] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.352] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa757bc90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa757bc90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.352] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa757bc90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa757bc90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.352] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa757bc90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa757bc90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa757bc90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.352] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.352] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.352] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.352] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864c72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="cs", cAlternateFileName="")) returned 1 [0038.352] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.353] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.353] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.353] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.353] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.353] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1830*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1830, pdwDataLen=0x18e0d0) returned 0 [0038.353] GetLastError () returned 0xea [0038.353] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1830*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1830*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.353] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.354] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1dd4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1dd4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.355] SetEndOfFile (hFile=0x10c) returned 1 [0038.355] CloseHandle (hObject=0x10c) returned 1 [0038.355] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.355] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.355] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.355] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.355] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa75a1df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.355] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.355] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864c72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.355] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.355] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="da", cAlternateFileName="")) returned 1 [0038.355] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.356] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.356] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.356] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.356] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.356] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b84*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1b84, pdwDataLen=0x18e0d0) returned 0 [0038.356] GetLastError () returned 0xea [0038.356] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b84*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1b84*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.356] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.357] WriteFile (in: hFile=0x10c, lpBuffer=0x33f259c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f259c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.358] SetEndOfFile (hFile=0x10c) returned 1 [0038.358] CloseHandle (hObject=0x10c) returned 1 [0038.358] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.358] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.358] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.359] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.359] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa75a1df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.359] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.359] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.359] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.359] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="de", cAlternateFileName="")) returned 1 [0038.359] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.359] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.359] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.359] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.359] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.360] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1e04*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1e04, pdwDataLen=0x18e0d0) returned 0 [0038.360] GetLastError () returned 0xea [0038.360] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1e04*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1e04*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.360] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.360] WriteFile (in: hFile=0x10c, lpBuffer=0x33f23c8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f23c8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.361] SetEndOfFile (hFile=0x10c) returned 1 [0038.361] CloseHandle (hObject=0x10c) returned 1 [0038.361] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.361] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.361] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.362] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.362] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa75a1df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.362] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.362] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.362] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.362] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ed410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x864ed410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="el", cAlternateFileName="")) returned 1 [0038.362] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.362] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.362] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.362] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.362] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.362] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0a94*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0a94, pdwDataLen=0x18e0d0) returned 0 [0038.362] GetLastError () returned 0xea [0038.362] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0a94*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0a94*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.363] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.364] WriteFile (in: hFile=0x10c, lpBuffer=0x33f22dc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f22dc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.365] SetEndOfFile (hFile=0x10c) returned 1 [0038.365] CloseHandle (hObject=0x10c) returned 1 [0038.365] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.365] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.365] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.365] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.365] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa75a1df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.365] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.365] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x864ebca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.365] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.365] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en_GB", cAlternateFileName="")) returned 1 [0038.365] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.366] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.366] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.366] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.366] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.366] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0d2c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0d2c, pdwDataLen=0x18e0d0) returned 0 [0038.366] GetLastError () returned 0xea [0038.366] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0d2c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0d2c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.366] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.367] WriteFile (in: hFile=0x10c, lpBuffer=0x33f21c4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f21c4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.367] SetEndOfFile (hFile=0x10c) returned 1 [0038.368] CloseHandle (hObject=0x10c) returned 1 [0038.368] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.368] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.368] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.368] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864ed410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.368] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa75a1df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa75a1df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75a1df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.368] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.368] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.368] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.368] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en_US", cAlternateFileName="")) returned 1 [0038.368] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.369] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.369] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.369] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.369] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.369] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1ebc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1ebc, pdwDataLen=0x18e0d0) returned 0 [0038.369] GetLastError () returned 0xea [0038.369] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1ebc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1ebc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.370] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.371] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2490*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2490*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.371] SetEndOfFile (hFile=0x10c) returned 1 [0038.372] CloseHandle (hObject=0x10c) returned 1 [0038.372] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.372] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.372] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.372] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.372] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa75c7f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.372] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.372] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.372] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.372] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es", cAlternateFileName="")) returned 1 [0038.372] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.373] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.373] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.373] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.373] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.373] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21b0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e21b0, pdwDataLen=0x18e0d0) returned 0 [0038.373] GetLastError () returned 0xea [0038.373] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21b0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e21b0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.373] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.374] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03a4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03a4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.374] SetEndOfFile (hFile=0x10c) returned 1 [0038.375] CloseHandle (hObject=0x10c) returned 1 [0038.375] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.375] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.375] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.375] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.375] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa75c7f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.375] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.375] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.375] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.375] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865396d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865396d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es_419", cAlternateFileName="")) returned 1 [0038.375] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.376] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.376] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.376] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.376] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.376] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0720, pdwDataLen=0x18e0d0) returned 0 [0038.376] GetLastError () returned 0xea [0038.376] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0720*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.376] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.377] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0988*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0988*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.378] SetEndOfFile (hFile=0x10c) returned 1 [0038.378] CloseHandle (hObject=0x10c) returned 1 [0038.378] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.378] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.378] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.378] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.378] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa75c7f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.378] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.378] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865396d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86539ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.379] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.379] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="et", cAlternateFileName="")) returned 1 [0038.379] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.379] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.379] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.379] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.379] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.379] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e070c, pdwDataLen=0x18e0d0) returned 0 [0038.379] GetLastError () returned 0xea [0038.379] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.380] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.380] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03f4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03f4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.381] SetEndOfFile (hFile=0x10c) returned 1 [0038.381] CloseHandle (hObject=0x10c) returned 1 [0038.381] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.381] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.381] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.381] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.381] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa75c7f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.381] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.381] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.381] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.382] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fi", cAlternateFileName="")) returned 1 [0038.382] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.382] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.382] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.382] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.382] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.382] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0080*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0080, pdwDataLen=0x18e0d0) returned 0 [0038.382] GetLastError () returned 0xea [0038.382] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0080*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0080*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.383] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.384] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0a4c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0a4c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.384] SetEndOfFile (hFile=0x10c) returned 1 [0038.385] CloseHandle (hObject=0x10c) returned 1 [0038.385] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.385] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.385] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.385] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75c7f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.385] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa75c7f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa75c7f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75ee0b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.385] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.385] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.385] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.385] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fil", cAlternateFileName="")) returned 1 [0038.385] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.386] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.386] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.386] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.386] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.386] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0070*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0070, pdwDataLen=0x18e0d0) returned 0 [0038.386] GetLastError () returned 0xea [0038.386] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0070*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0070*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.386] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.386] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0a6c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0a6c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.388] SetEndOfFile (hFile=0x10c) returned 1 [0038.388] CloseHandle (hObject=0x10c) returned 1 [0038.388] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.388] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.388] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75ee0b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75ee0b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.388] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75ee0b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75ee0b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.388] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa75ee0b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa75ee0b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75ee0b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.388] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.388] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.388] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.388] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fr", cAlternateFileName="")) returned 1 [0038.388] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.389] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.389] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.389] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.389] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.389] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0070*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0070, pdwDataLen=0x18e0d0) returned 0 [0038.389] GetLastError () returned 0xea [0038.389] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0070*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0070*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.389] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.390] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d08*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d08*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.391] SetEndOfFile (hFile=0x10c) returned 1 [0038.391] CloseHandle (hObject=0x10c) returned 1 [0038.391] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.391] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.391] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75ee0b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75ee0b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.391] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75ee0b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75ee0b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.391] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa75ee0b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa75ee0b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75ee0b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.391] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.391] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.391] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.391] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655f830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8655f830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="he", cAlternateFileName="")) returned 1 [0038.391] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.392] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.392] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.392] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.392] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.392] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.392] GetLastError () returned 0xea [0038.392] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.392] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.399] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2074*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2074*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.400] SetEndOfFile (hFile=0x10c) returned 1 [0038.400] CloseHandle (hObject=0x10c) returned 1 [0038.400] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.400] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.400] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75ee0b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75ee0b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.400] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa75ee0b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75ee0b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.400] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa75ee0b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa75ee0b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa75ee0b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.400] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.400] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8655f830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8655e890, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.400] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.400] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hi", cAlternateFileName="")) returned 1 [0038.400] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.401] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.401] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.401] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.401] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.401] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.401] GetLastError () returned 0xea [0038.401] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.401] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.402] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2658*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2658*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.403] SetEndOfFile (hFile=0x10c) returned 1 [0038.403] CloseHandle (hObject=0x10c) returned 1 [0038.403] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.403] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.403] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.403] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.403] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7614210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.403] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.403] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.403] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.403] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7555b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7555b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7555b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.403] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hu", cAlternateFileName="")) returned 1 [0038.404] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.404] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.404] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.404] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.404] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.404] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.404] GetLastError () returned 0xea [0038.404] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.405] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.406] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0de8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0de8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.406] SetEndOfFile (hFile=0x10c) returned 1 [0038.406] CloseHandle (hObject=0x10c) returned 1 [0038.407] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.407] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.407] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.407] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.407] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7614210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.407] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.407] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.407] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.407] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="id", cAlternateFileName="")) returned 1 [0038.407] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.408] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.408] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.408] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.408] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.408] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.408] GetLastError () returned 0xea [0038.408] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.408] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.408] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1548*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1548*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.409] SetEndOfFile (hFile=0x10c) returned 1 [0038.409] CloseHandle (hObject=0x10c) returned 1 [0038.410] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.410] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.410] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.410] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.410] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7614210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.410] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.410] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.410] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.410] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="it", cAlternateFileName="")) returned 1 [0038.410] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.411] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.411] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.411] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.411] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.411] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.411] GetLastError () returned 0xea [0038.411] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.411] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2054*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2054*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.412] SetEndOfFile (hFile=0x10c) returned 1 [0038.412] CloseHandle (hObject=0x10c) returned 1 [0038.412] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.412] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.412] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.413] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.413] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7614210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.413] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.413] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.413] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.413] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ja", cAlternateFileName="")) returned 1 [0038.413] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.414] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.414] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.414] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.414] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.414] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17e8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17e8, pdwDataLen=0x18e0d0) returned 0 [0038.414] GetLastError () returned 0xea [0038.414] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17e8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17e8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.414] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.414] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03e4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03e4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.415] SetEndOfFile (hFile=0x10c) returned 1 [0038.415] CloseHandle (hObject=0x10c) returned 1 [0038.415] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.415] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.415] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.416] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.416] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7614210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7614210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7614210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.416] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.416] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.416] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.416] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86585990, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ko", cAlternateFileName="")) returned 1 [0038.416] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.417] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.417] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.417] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.417] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.417] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17d8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17d8, pdwDataLen=0x18e0d0) returned 0 [0038.417] GetLastError () returned 0xea [0038.417] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17d8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17d8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.417] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.418] WriteFile (in: hFile=0x10c, lpBuffer=0x33e120c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e120c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.419] SetEndOfFile (hFile=0x10c) returned 1 [0038.419] CloseHandle (hObject=0x10c) returned 1 [0038.419] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.419] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.419] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.420] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.420] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa763a370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.420] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.420] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86585990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86585990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.420] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.420] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lt", cAlternateFileName="")) returned 1 [0038.420] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.421] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.421] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.421] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.421] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.421] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0070*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0070, pdwDataLen=0x18e0d0) returned 0 [0038.421] GetLastError () returned 0xea [0038.421] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0070*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0070*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.421] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d18*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d18*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.422] SetEndOfFile (hFile=0x10c) returned 1 [0038.422] CloseHandle (hObject=0x10c) returned 1 [0038.422] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.422] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.422] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.423] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.423] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa763a370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.423] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.423] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.423] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.423] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865abaf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865abaf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lv", cAlternateFileName="")) returned 1 [0038.423] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.423] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.424] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.424] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.424] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.424] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.424] GetLastError () returned 0xea [0038.424] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.424] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.424] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2084*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2084*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.425] SetEndOfFile (hFile=0x10c) returned 1 [0038.426] CloseHandle (hObject=0x10c) returned 1 [0038.426] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.426] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.426] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.426] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.426] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa763a370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.426] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.426] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865abaf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865aa380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.426] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.426] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865d1c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ms", cAlternateFileName="")) returned 1 [0038.426] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.427] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.427] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.427] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.427] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.427] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.427] GetLastError () returned 0xea [0038.427] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.427] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.427] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2628*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2628*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.429] SetEndOfFile (hFile=0x10c) returned 1 [0038.429] CloseHandle (hObject=0x10c) returned 1 [0038.429] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.429] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.429] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.429] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.429] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa763a370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.429] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.429] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865d1480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.429] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.429] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f7db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x865f7db0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="nl", cAlternateFileName="")) returned 1 [0038.429] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.430] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.430] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.430] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.430] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.430] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.430] GetLastError () returned 0xea [0038.430] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.430] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.448] WriteFile (in: hFile=0x10c, lpBuffer=0x33e06f0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e06f0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.449] SetEndOfFile (hFile=0x10c) returned 1 [0038.449] CloseHandle (hObject=0x10c) returned 1 [0038.449] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.449] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.449] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.450] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865d1c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa763a370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.450] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa763a370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa763a370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7686630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.450] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.450] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x865f8580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.450] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.450] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="no", cAlternateFileName="")) returned 1 [0038.450] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.450] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.450] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.450] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.451] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.451] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0708, pdwDataLen=0x18e0d0) returned 0 [0038.451] GetLastError () returned 0xea [0038.451] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.451] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.451] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03e4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03e4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.452] SetEndOfFile (hFile=0x10c) returned 1 [0038.452] CloseHandle (hObject=0x10c) returned 1 [0038.452] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.452] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.452] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7686630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7686630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.453] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x865f7db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7686630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7686630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.453] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7686630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7686630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7686630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.453] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.453] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.453] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.453] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8661df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pl", cAlternateFileName="")) returned 1 [0038.453] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.453] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.453] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.453] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.453] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.454] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17e8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17e8, pdwDataLen=0x18e0d0) returned 0 [0038.454] GetLastError () returned 0xea [0038.454] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17e8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17e8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.454] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.454] WriteFile (in: hFile=0x10c, lpBuffer=0x33e199c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e199c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.455] SetEndOfFile (hFile=0x10c) returned 1 [0038.455] CloseHandle (hObject=0x10c) returned 1 [0038.455] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.455] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7686630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7686630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.456] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7686630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7686630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.456] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7686630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7686630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7686630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.456] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.456] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8661df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8661cf70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.456] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.456] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0038.456] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.456] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.456] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.456] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.456] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.456] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e121c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e121c, pdwDataLen=0x18e0d0) returned 0 [0038.457] GetLastError () returned 0xea [0038.457] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e121c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e121c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.457] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.457] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2e08*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2e08*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.458] SetEndOfFile (hFile=0x10c) returned 1 [0038.458] CloseHandle (hObject=0x10c) returned 1 [0038.458] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.458] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7686630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7686630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.458] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7686630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7686630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.458] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7686630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7686630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7686630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.459] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.459] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.459] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.459] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86644070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0038.459] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.459] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.459] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.459] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.459] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.459] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e0d0) returned 0 [0038.459] GetLastError () returned 0xea [0038.459] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.463] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0080*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0080*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.464] SetEndOfFile (hFile=0x10c) returned 1 [0038.464] CloseHandle (hObject=0x10c) returned 1 [0038.464] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.464] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.464] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.464] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.464] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76ac790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.464] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.464] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86644070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86644070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.464] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.464] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ro", cAlternateFileName="")) returned 1 [0038.465] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.465] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.465] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.465] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.465] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.465] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0084*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0084, pdwDataLen=0x18e0d0) returned 0 [0038.465] GetLastError () returned 0xea [0038.465] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0084*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0084*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.466] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.466] WriteFile (in: hFile=0x10c, lpBuffer=0x33f17d0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f17d0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.467] SetEndOfFile (hFile=0x10c) returned 1 [0038.467] CloseHandle (hObject=0x10c) returned 1 [0038.467] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.467] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.467] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.467] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8666a1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.467] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76ac790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.467] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.467] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.467] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.467] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86690330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86690330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ru", cAlternateFileName="")) returned 1 [0038.467] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.468] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.468] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.468] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.468] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.468] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.468] GetLastError () returned 0xea [0038.468] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.468] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.469] WriteFile (in: hFile=0x10c, lpBuffer=0x33f17d0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f17d0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.470] SetEndOfFile (hFile=0x10c) returned 1 [0038.470] CloseHandle (hObject=0x10c) returned 1 [0038.470] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.470] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.470] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.470] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.470] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76ac790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.470] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.470] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86690330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8668fb60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.470] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.471] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sk", cAlternateFileName="")) returned 1 [0038.471] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.471] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.471] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.471] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.471] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.471] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0df0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0df0, pdwDataLen=0x18e0d0) returned 0 [0038.471] GetLastError () returned 0xea [0038.471] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0df0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0df0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.472] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.473] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03b4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03b4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.474] SetEndOfFile (hFile=0x10c) returned 1 [0038.474] CloseHandle (hObject=0x10c) returned 1 [0038.474] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.474] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.474] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.474] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.474] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76ac790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.474] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.474] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.474] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.474] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866b6490, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sl", cAlternateFileName="")) returned 1 [0038.474] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.475] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.475] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.475] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.475] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.475] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17f8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17f8, pdwDataLen=0x18e0d0) returned 0 [0038.475] GetLastError () returned 0xea [0038.475] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17f8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17f8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.475] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.476] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2198*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2198*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.477] SetEndOfFile (hFile=0x10c) returned 1 [0038.477] CloseHandle (hObject=0x10c) returned 1 [0038.477] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.477] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.477] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.477] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.477] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76ac790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76ac790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76ac790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.477] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.477] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866b6490, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866b6c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.477] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.477] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sr", cAlternateFileName="")) returned 1 [0038.477] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.478] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.478] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.478] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.478] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.478] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11f4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e11f4, pdwDataLen=0x18e0d0) returned 0 [0038.478] GetLastError () returned 0xea [0038.478] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11f4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e11f4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.479] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03f4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03f4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.480] SetEndOfFile (hFile=0x10c) returned 1 [0038.480] CloseHandle (hObject=0x10c) returned 1 [0038.480] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.480] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.480] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.480] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.480] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76d28f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.480] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.480] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.480] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.480] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sv", cAlternateFileName="")) returned 1 [0038.480] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.481] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.481] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.481] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.481] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.481] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e0d0) returned 0 [0038.481] GetLastError () returned 0xea [0038.481] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.481] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.482] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2a8c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2a8c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.483] SetEndOfFile (hFile=0x10c) returned 1 [0038.483] CloseHandle (hObject=0x10c) returned 1 [0038.483] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.483] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.483] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.483] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.483] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76d28f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.483] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.483] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.483] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.484] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="th", cAlternateFileName="")) returned 1 [0038.484] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.484] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.484] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.484] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.484] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.484] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03fc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03fc, pdwDataLen=0x18e0d0) returned 0 [0038.484] GetLastError () returned 0xea [0038.484] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03fc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03fc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.485] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.486] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1578*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1578*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.486] SetEndOfFile (hFile=0x10c) returned 1 [0038.487] CloseHandle (hObject=0x10c) returned 1 [0038.487] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.487] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.487] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.487] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.487] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76d28f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.487] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.487] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.487] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.487] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866dc5f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x866dc5f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="tr", cAlternateFileName="")) returned 1 [0038.487] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.488] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.488] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.488] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.488] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.488] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.488] GetLastError () returned 0xea [0038.488] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.488] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.488] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2074*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2074*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.489] SetEndOfFile (hFile=0x10c) returned 1 [0038.489] CloseHandle (hObject=0x10c) returned 1 [0038.490] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.490] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.490] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.490] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.490] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76d28f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.490] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.490] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x866db650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.490] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.490] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="uk", cAlternateFileName="")) returned 1 [0038.490] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.491] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.491] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.491] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.491] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.491] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.491] GetLastError () returned 0xea [0038.491] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.491] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.491] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2688*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2688*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.492] SetEndOfFile (hFile=0x10c) returned 1 [0038.492] CloseHandle (hObject=0x10c) returned 1 [0038.492] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.492] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.493] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.493] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x866dc5f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.493] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76d28f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76d28f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76d28f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.493] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.493] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.493] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.493] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="vi", cAlternateFileName="")) returned 1 [0038.493] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.494] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.494] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.494] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.494] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.494] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.494] GetLastError () returned 0xea [0038.494] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.494] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.495] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1bd0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1bd0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.496] SetEndOfFile (hFile=0x10c) returned 1 [0038.496] CloseHandle (hObject=0x10c) returned 1 [0038.496] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.496] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.496] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76f8a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.496] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.496] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0038.496] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.497] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.497] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.497] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.497] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.497] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f0060, pdwDataLen=0x18e0d0) returned 0 [0038.497] GetLastError () returned 0xea [0038.497] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f0060*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.498] WriteFile (in: hFile=0x10c, lpBuffer=0x33e15c4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e15c4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.499] SetEndOfFile (hFile=0x10c) returned 1 [0038.499] CloseHandle (hObject=0x10c) returned 1 [0038.499] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.499] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.499] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.500] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.500] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76f8a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.500] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.500] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.500] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.500] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0038.500] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.500] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.500] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.500] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.500] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.500] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15e0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e15e0, pdwDataLen=0x18e0d0) returned 0 [0038.500] GetLastError () returned 0xea [0038.500] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15e0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e15e0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.501] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.501] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1b94*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1b94*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.502] SetEndOfFile (hFile=0x10c) returned 1 [0038.502] CloseHandle (hObject=0x10c) returned 1 [0038.502] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.502] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.502] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.502] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.502] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76f8a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.502] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.502] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.503] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.503] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86702750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86702750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86702750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0038.503] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0038.503] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0038.503] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0038.503] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0038.503] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.503] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c9180) returned 1 [0038.503] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0038.503] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e338) returned 0 [0038.503] GetLastError () returned 0xea [0038.503] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e334*=0x260) returned 1 [0038.504] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.506] WriteFile (in: hFile=0x100, lpBuffer=0x33f2acc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33f2acc*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0038.507] SetEndOfFile (hFile=0x100) returned 1 [0038.507] CloseHandle (hObject=0x100) returned 1 [0038.507] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.507] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.507] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.507] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.507] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0038.507] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76f8a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.507] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0038.507] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86727140, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe051a00, ftLastWriteTime.dwHighDateTime=0x1d03f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0038.507] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.507] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x867288b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0038.507] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.507] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7555b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7555b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7555b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x79726e6f, dwReserved1=0x52747470, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.507] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7555b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7555b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7555b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x79726e6f, dwReserved1=0x52747470, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.507] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.507] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="apdfllckaahabafndbhieahigkjlhalf", cAlternateFileName="APDFLL~1")) returned 1 [0038.507] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0038.508] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0038.508] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.508] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c90c0) returned 1 [0038.508] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.508] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e808) returned 0 [0038.508] GetLastError () returned 0xea [0038.508] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e804*=0x260) returned 1 [0038.508] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0038.509] WriteFile (in: hFile=0x104, lpBuffer=0x33f2e38*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33f2e38*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0038.510] SetEndOfFile (hFile=0x104) returned 1 [0038.510] CloseHandle (hObject=0x104) returned 1 [0038.510] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.510] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.511] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.511] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x819d0bd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa76f8a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.511] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa23102d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa23102d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="14.1_0", cAlternateFileName="")) returned 1 [0038.511] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0038.511] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0038.511] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.511] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9180) returned 1 [0038.511] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.511] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f26c8*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33f26c8, pdwDataLen=0x18e5a0) returned 0 [0038.511] GetLastError () returned 0xea [0038.511] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f26c8*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33f26c8*, pdwDataLen=0x18e59c*=0x260) returned 1 [0038.512] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.512] WriteFile (in: hFile=0xfc, lpBuffer=0x33e0ea0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33e0ea0*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0038.513] SetEndOfFile (hFile=0xfc) returned 1 [0038.513] CloseHandle (hObject=0xfc) returned 1 [0038.515] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.515] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.515] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa771ebb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa771ebb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.516] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa771ebb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa771ebb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.516] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa22ea170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa22ea170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa23102d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1a33, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="128.png.crypt", cAlternateFileName="128PNG~1.CRY")) returned 1 [0038.516] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa771ebb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa771ebb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa771ebb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.516] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8716c790, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0038.516] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_locales", cAlternateFileName="")) returned 1 [0038.516] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0038.516] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0038.516] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.516] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c91c0) returned 1 [0038.516] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.516] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e338) returned 0 [0038.516] GetLastError () returned 0xea [0038.516] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e334*=0x260) returned 1 [0038.517] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.519] WriteFile (in: hFile=0x100, lpBuffer=0x33f2510*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33f2510*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0038.519] SetEndOfFile (hFile=0x100) returned 1 [0038.520] CloseHandle (hObject=0x100) returned 1 [0038.520] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0038.520] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.520] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa771ebb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa771ebb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0038.520] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e26950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa771ebb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa771ebb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.520] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ar", cAlternateFileName="")) returned 1 [0038.520] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.521] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.521] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.521] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.521] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.521] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d90*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d90, pdwDataLen=0x18e0d0) returned 0 [0038.521] GetLastError () returned 0xea [0038.521] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d90*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d90*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.525] WriteFile (in: hFile=0x10c, lpBuffer=0x33f27a8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f27a8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.526] SetEndOfFile (hFile=0x10c) returned 1 [0038.526] CloseHandle (hObject=0x10c) returned 1 [0038.526] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.526] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa771ebb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa771ebb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.526] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa771ebb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa771ebb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.526] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa771ebb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa771ebb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7744d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.526] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.527] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.527] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.527] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="bg", cAlternateFileName="")) returned 1 [0038.527] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.527] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.527] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.527] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.527] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.527] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d80, pdwDataLen=0x18e0d0) returned 0 [0038.527] GetLastError () returned 0xea [0038.527] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.529] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2b04*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2b04*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.530] SetEndOfFile (hFile=0x10c) returned 1 [0038.530] CloseHandle (hObject=0x10c) returned 1 [0038.530] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.530] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.530] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7744d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7744d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.530] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7744d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7744d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.530] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7744d10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7744d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7744d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.530] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.530] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.530] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.530] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ca", cAlternateFileName="")) returned 1 [0038.530] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.531] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.531] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.531] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.531] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.531] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0e20*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0e20, pdwDataLen=0x18e0d0) returned 0 [0038.531] GetLastError () returned 0xea [0038.531] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0e20*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0e20*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.531] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.532] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2884*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2884*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.532] SetEndOfFile (hFile=0x10c) returned 1 [0038.533] CloseHandle (hObject=0x10c) returned 1 [0038.533] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.533] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.533] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7744d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7744d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.533] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7744d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7744d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.533] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7744d10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7744d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7744d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.533] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.533] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.533] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.533] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="cs", cAlternateFileName="")) returned 1 [0038.533] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.534] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.534] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.534] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.534] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.534] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e10a0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e10a0, pdwDataLen=0x18e0d0) returned 0 [0038.534] GetLastError () returned 0xea [0038.534] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e10a0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e10a0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.534] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.534] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1e14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1e14*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.535] SetEndOfFile (hFile=0x10c) returned 1 [0038.535] CloseHandle (hObject=0x10c) returned 1 [0038.536] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.536] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.536] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7744d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7744d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7744d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7744d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7744d10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7744d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7744d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.536] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.536] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="da", cAlternateFileName="")) returned 1 [0038.536] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.537] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.537] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.537] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.537] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.537] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f10*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2f10, pdwDataLen=0x18e0d0) returned 0 [0038.537] GetLastError () returned 0xea [0038.537] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f10*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2f10*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.537] WriteFile (in: hFile=0x10c, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.538] SetEndOfFile (hFile=0x10c) returned 1 [0038.538] CloseHandle (hObject=0x10c) returned 1 [0038.538] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.538] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.538] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7744d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7744d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.539] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7744d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7744d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.539] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7744d10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7744d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7744d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.539] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.539] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.539] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.539] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="de", cAlternateFileName="")) returned 1 [0038.539] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.539] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.539] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.539] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.540] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.540] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f20ec*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f20ec, pdwDataLen=0x18e0d0) returned 0 [0038.540] GetLastError () returned 0xea [0038.540] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f20ec*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f20ec*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.540] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.541] WriteFile (in: hFile=0x10c, lpBuffer=0x33f26a0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f26a0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.542] SetEndOfFile (hFile=0x10c) returned 1 [0038.542] CloseHandle (hObject=0x10c) returned 1 [0038.542] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.542] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.542] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa776ae70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.542] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.542] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="el", cAlternateFileName="")) returned 1 [0038.542] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.543] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.543] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.543] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.543] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.543] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e20ac, pdwDataLen=0x18e0d0) returned 0 [0038.543] GetLastError () returned 0xea [0038.543] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e20ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.543] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.544] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.545] SetEndOfFile (hFile=0x10c) returned 1 [0038.545] CloseHandle (hObject=0x10c) returned 1 [0038.545] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.545] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.545] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.545] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.545] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa776ae70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.545] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.545] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.545] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.545] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en_GB", cAlternateFileName="")) returned 1 [0038.546] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.546] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.546] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.546] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.546] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.546] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0720, pdwDataLen=0x18e0d0) returned 0 [0038.546] GetLastError () returned 0xea [0038.546] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0720*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.547] WriteFile (in: hFile=0x10c, lpBuffer=0x33e14c4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e14c4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.548] SetEndOfFile (hFile=0x10c) returned 1 [0038.548] CloseHandle (hObject=0x10c) returned 1 [0038.548] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.548] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.548] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa776ae70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.548] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.548] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en_US", cAlternateFileName="")) returned 1 [0038.548] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.549] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.549] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.549] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.549] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.549] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0d30*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0d30, pdwDataLen=0x18e0d0) returned 0 [0038.549] GetLastError () returned 0xea [0038.549] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0d30*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0d30*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.549] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.551] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1ab4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1ab4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.551] SetEndOfFile (hFile=0x10c) returned 1 [0038.552] CloseHandle (hObject=0x10c) returned 1 [0038.552] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.552] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.552] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.552] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa776ae70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.552] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.552] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.552] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.552] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es", cAlternateFileName="")) returned 1 [0038.552] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.553] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.553] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.553] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.553] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.553] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d94*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d94, pdwDataLen=0x18e0d0) returned 0 [0038.553] GetLastError () returned 0xea [0038.553] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d94*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d94*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.553] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.554] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.554] SetEndOfFile (hFile=0x10c) returned 1 [0038.554] CloseHandle (hObject=0x10c) returned 1 [0038.555] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.555] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.555] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.555] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.555] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa776ae70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa776ae70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa776ae70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.555] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.555] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.555] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.555] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es_419", cAlternateFileName="")) returned 1 [0038.555] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.556] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.556] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.556] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.556] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.556] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d80, pdwDataLen=0x18e0d0) returned 0 [0038.556] GetLastError () returned 0xea [0038.556] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.556] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.557] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.558] SetEndOfFile (hFile=0x10c) returned 1 [0038.558] CloseHandle (hObject=0x10c) returned 1 [0038.558] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.558] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.558] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.558] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.558] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7790fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.558] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.558] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.558] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.558] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="et", cAlternateFileName="")) returned 1 [0038.558] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.559] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.559] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.559] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.559] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.559] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d80, pdwDataLen=0x18e0d0) returned 0 [0038.559] GetLastError () returned 0xea [0038.559] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.559] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.560] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2af4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2af4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.561] SetEndOfFile (hFile=0x10c) returned 1 [0038.561] CloseHandle (hObject=0x10c) returned 1 [0038.561] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.561] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.561] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.562] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.562] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7790fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.562] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.562] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.562] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.562] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="eu", cAlternateFileName="")) returned 1 [0038.562] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.562] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.562] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.562] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.562] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.563] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0718*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0718, pdwDataLen=0x18e0d0) returned 0 [0038.563] GetLastError () returned 0xea [0038.563] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0718*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0718*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.563] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.563] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0980*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0980*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.564] SetEndOfFile (hFile=0x10c) returned 1 [0038.564] CloseHandle (hObject=0x10c) returned 1 [0038.564] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.564] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.564] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.565] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.565] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7790fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.565] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.565] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.565] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.565] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fi", cAlternateFileName="")) returned 1 [0038.565] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.565] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.565] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.565] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.565] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.565] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0998*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0998, pdwDataLen=0x18e0d0) returned 0 [0038.565] GetLastError () returned 0xea [0038.565] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0998*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0998*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.566] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.566] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1aa8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1aa8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.567] SetEndOfFile (hFile=0x10c) returned 1 [0038.567] CloseHandle (hObject=0x10c) returned 1 [0038.567] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.567] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.567] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.568] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.568] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7790fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.568] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.568] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.568] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.568] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fil", cAlternateFileName="")) returned 1 [0038.568] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.568] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.568] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.568] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.569] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.569] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1330*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1330, pdwDataLen=0x18e0d0) returned 0 [0038.569] GetLastError () returned 0xea [0038.569] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1330*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1330*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.569] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.570] WriteFile (in: hFile=0x10c, lpBuffer=0x33e20a4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e20a4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.571] SetEndOfFile (hFile=0x10c) returned 1 [0038.571] CloseHandle (hObject=0x10c) returned 1 [0038.571] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.571] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.571] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.571] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.571] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7790fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7790fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7790fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.571] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.572] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.572] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.572] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fr", cAlternateFileName="")) returned 1 [0038.572] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.572] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.572] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.572] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.572] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.572] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e190c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e190c, pdwDataLen=0x18e0d0) returned 0 [0038.572] GetLastError () returned 0xea [0038.572] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e190c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e190c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.573] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.573] WriteFile (in: hFile=0x10c, lpBuffer=0x33e21b8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e21b8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.574] SetEndOfFile (hFile=0x10c) returned 1 [0038.574] CloseHandle (hObject=0x10c) returned 1 [0038.574] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.574] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.574] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.574] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.575] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa77b7130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.575] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.575] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.575] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.575] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="he", cAlternateFileName="")) returned 1 [0038.575] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.575] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.575] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.575] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.575] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.575] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1b8c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1b8c, pdwDataLen=0x18e0d0) returned 0 [0038.575] GetLastError () returned 0xea [0038.575] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1b8c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1b8c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.576] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.576] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0a5c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0a5c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.577] SetEndOfFile (hFile=0x10c) returned 1 [0038.577] CloseHandle (hObject=0x10c) returned 1 [0038.577] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.577] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.577] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.577] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.577] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa77b7130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.577] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.578] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.578] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.578] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hi", cAlternateFileName="")) returned 1 [0038.578] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.578] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.578] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.578] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.578] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.578] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0a84*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0a84, pdwDataLen=0x18e0d0) returned 0 [0038.578] GetLastError () returned 0xea [0038.578] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0a84*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0a84*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.579] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.580] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1ef0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1ef0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.581] SetEndOfFile (hFile=0x10c) returned 1 [0038.581] CloseHandle (hObject=0x10c) returned 1 [0038.581] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.581] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.581] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.581] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.581] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa77b7130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.581] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.581] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.581] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.581] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa771ebb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa771ebb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa771ebb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.581] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hr", cAlternateFileName="")) returned 1 [0038.581] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.582] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.582] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.582] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.582] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.582] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d90*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d90, pdwDataLen=0x18e0d0) returned 0 [0038.582] GetLastError () returned 0xea [0038.582] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d90*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d90*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.582] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.583] WriteFile (in: hFile=0x10c, lpBuffer=0x33f27a8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f27a8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.584] SetEndOfFile (hFile=0x10c) returned 1 [0038.584] CloseHandle (hObject=0x10c) returned 1 [0038.584] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.584] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.584] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.584] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.584] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa77b7130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.584] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.584] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.584] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.584] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hu", cAlternateFileName="")) returned 1 [0038.584] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.585] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.585] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.585] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.585] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.585] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0708, pdwDataLen=0x18e0d0) returned 0 [0038.585] GetLastError () returned 0xea [0038.585] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.585] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.586] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.587] SetEndOfFile (hFile=0x10c) returned 1 [0038.587] CloseHandle (hObject=0x10c) returned 1 [0038.587] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.587] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.587] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.587] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.587] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa77b7130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa77b7130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77b7130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.587] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.587] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.587] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.587] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="id", cAlternateFileName="")) returned 1 [0038.587] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.588] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.588] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.588] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.588] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.588] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1338*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1338, pdwDataLen=0x18e0d0) returned 0 [0038.588] GetLastError () returned 0xea [0038.588] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1338*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1338*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.588] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.590] WriteFile (in: hFile=0x10c, lpBuffer=0x33e20bc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e20bc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.591] SetEndOfFile (hFile=0x10c) returned 1 [0038.591] CloseHandle (hObject=0x10c) returned 1 [0038.591] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.591] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.591] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.591] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.591] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa77dd290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.591] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.591] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.591] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.591] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="it", cAlternateFileName="")) returned 1 [0038.591] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.592] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.592] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.592] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.592] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.592] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1da0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1da0, pdwDataLen=0x18e0d0) returned 0 [0038.592] GetLastError () returned 0xea [0038.592] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1da0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1da0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.592] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.593] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.594] SetEndOfFile (hFile=0x10c) returned 1 [0038.594] CloseHandle (hObject=0x10c) returned 1 [0038.594] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.594] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.594] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.594] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.594] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa77dd290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.594] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.594] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.594] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.594] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ja", cAlternateFileName="")) returned 1 [0038.594] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.595] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.595] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.595] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.595] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.595] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2020*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2020, pdwDataLen=0x18e0d0) returned 0 [0038.595] GetLastError () returned 0xea [0038.595] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2020*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2020*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.595] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.596] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2064*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2064*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.597] SetEndOfFile (hFile=0x10c) returned 1 [0038.597] CloseHandle (hObject=0x10c) returned 1 [0038.597] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.597] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.597] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.597] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.597] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa77dd290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.597] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.597] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.597] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.598] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ko", cAlternateFileName="")) returned 1 [0038.598] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.598] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.598] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.598] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.598] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.598] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d80, pdwDataLen=0x18e0d0) returned 0 [0038.598] GetLastError () returned 0xea [0038.598] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.599] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.600] WriteFile (in: hFile=0x10c, lpBuffer=0x33e18d4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e18d4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.600] SetEndOfFile (hFile=0x10c) returned 1 [0038.601] CloseHandle (hObject=0x10c) returned 1 [0038.601] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.601] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.601] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.601] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.601] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa77dd290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.601] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.601] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.601] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.601] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lt", cAlternateFileName="")) returned 1 [0038.601] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.602] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.602] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.602] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.602] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.602] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0718*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0718, pdwDataLen=0x18e0d0) returned 0 [0038.602] GetLastError () returned 0xea [0038.602] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0718*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0718*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.602] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.602] WriteFile (in: hFile=0x10c, lpBuffer=0x33e148c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e148c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.603] SetEndOfFile (hFile=0x10c) returned 1 [0038.603] CloseHandle (hObject=0x10c) returned 1 [0038.604] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.604] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.604] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.604] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa77dd290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.604] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa77dd290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa77dd290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.604] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.604] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.604] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.604] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lv", cAlternateFileName="")) returned 1 [0038.604] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.605] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.605] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.605] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.605] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.605] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0ce4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0ce4, pdwDataLen=0x18e0d0) returned 0 [0038.605] GetLastError () returned 0xea [0038.605] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0ce4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0ce4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.605] WriteFile (in: hFile=0x10c, lpBuffer=0x33e191c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e191c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.606] SetEndOfFile (hFile=0x10c) returned 1 [0038.606] CloseHandle (hObject=0x10c) returned 1 [0038.607] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.607] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.607] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.607] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.607] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78033f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.607] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.607] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.607] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.607] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ms", cAlternateFileName="")) returned 1 [0038.607] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.608] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.608] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.608] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.608] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.608] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e12f0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e12f0, pdwDataLen=0x18e0d0) returned 0 [0038.608] GetLastError () returned 0xea [0038.608] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e12f0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e12f0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.608] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.609] WriteFile (in: hFile=0x10c, lpBuffer=0x33e18b4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e18b4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.610] SetEndOfFile (hFile=0x10c) returned 1 [0038.610] CloseHandle (hObject=0x10c) returned 1 [0038.610] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.610] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.610] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.610] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.611] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78033f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.611] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.611] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.611] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.611] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="nl", cAlternateFileName="")) returned 1 [0038.611] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.611] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.611] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.611] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.611] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.611] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c18*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2c18, pdwDataLen=0x18e0d0) returned 0 [0038.611] GetLastError () returned 0xea [0038.611] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c18*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2c18*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.612] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.612] WriteFile (in: hFile=0x10c, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.613] SetEndOfFile (hFile=0x10c) returned 1 [0038.613] CloseHandle (hObject=0x10c) returned 1 [0038.613] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.613] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.613] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.613] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.613] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78033f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.614] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.614] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.614] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.614] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="no", cAlternateFileName="")) returned 1 [0038.614] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.614] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.614] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.614] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.614] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.614] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d80, pdwDataLen=0x18e0d0) returned 0 [0038.614] GetLastError () returned 0xea [0038.614] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.615] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.616] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2000*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2000*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.617] SetEndOfFile (hFile=0x10c) returned 1 [0038.617] CloseHandle (hObject=0x10c) returned 1 [0038.617] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.617] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.617] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.617] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.617] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78033f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.617] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.617] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.617] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.617] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pl", cAlternateFileName="")) returned 1 [0038.617] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.618] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.618] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.618] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.618] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.618] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d80, pdwDataLen=0x18e0d0) returned 0 [0038.618] GetLastError () returned 0xea [0038.618] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.618] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.619] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.620] SetEndOfFile (hFile=0x10c) returned 1 [0038.620] CloseHandle (hObject=0x10c) returned 1 [0038.620] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.620] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.620] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78033f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.620] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78033f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78033f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7829550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.620] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.620] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.620] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.620] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0038.620] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.621] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.621] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.621] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.621] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.621] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d80, pdwDataLen=0x18e0d0) returned 0 [0038.621] GetLastError () returned 0xea [0038.621] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.621] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.622] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2028*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2028*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.623] SetEndOfFile (hFile=0x10c) returned 1 [0038.623] CloseHandle (hObject=0x10c) returned 1 [0038.623] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.623] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7829550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7829550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.624] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7829550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7829550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.624] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7829550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7829550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7829550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.624] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.624] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.624] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.624] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0038.624] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.624] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.625] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.625] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.625] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.625] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d80, pdwDataLen=0x18e0d0) returned 0 [0038.625] GetLastError () returned 0xea [0038.625] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.625] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.626] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2b04*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2b04*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.627] SetEndOfFile (hFile=0x10c) returned 1 [0038.627] CloseHandle (hObject=0x10c) returned 1 [0038.627] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.627] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.627] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7829550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7829550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.627] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7829550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7829550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.627] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7829550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7829550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7829550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.627] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.628] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.628] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.628] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ro", cAlternateFileName="")) returned 1 [0038.628] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.628] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.628] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.628] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.628] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.628] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0748*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0748, pdwDataLen=0x18e0d0) returned 0 [0038.628] GetLastError () returned 0xea [0038.628] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0748*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0748*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.629] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.629] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2240*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2240*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.630] SetEndOfFile (hFile=0x10c) returned 1 [0038.630] CloseHandle (hObject=0x10c) returned 1 [0038.630] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.630] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.630] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7829550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7829550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.630] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7829550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7829550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.630] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7829550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7829550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7829550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.630] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.631] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.631] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.631] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ru", cAlternateFileName="")) returned 1 [0038.631] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.631] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.631] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.631] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.631] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.631] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e09c8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e09c8, pdwDataLen=0x18e0d0) returned 0 [0038.631] GetLastError () returned 0xea [0038.631] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e09c8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e09c8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.632] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.632] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1e24*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1e24*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.633] SetEndOfFile (hFile=0x10c) returned 1 [0038.633] CloseHandle (hObject=0x10c) returned 1 [0038.633] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.633] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.633] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7829550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7829550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.634] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7829550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7829550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.634] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7829550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7829550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7829550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.634] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.634] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.634] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.634] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sk", cAlternateFileName="")) returned 1 [0038.634] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.634] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.634] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.634] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.634] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.635] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1da0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1da0, pdwDataLen=0x18e0d0) returned 0 [0038.635] GetLastError () returned 0xea [0038.635] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1da0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1da0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.635] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.635] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2364*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2364*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.636] SetEndOfFile (hFile=0x10c) returned 1 [0038.636] CloseHandle (hObject=0x10c) returned 1 [0038.636] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.636] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.636] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.637] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.637] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa784f6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.637] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.637] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.637] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.637] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sl", cAlternateFileName="")) returned 1 [0038.637] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.637] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.637] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.637] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.637] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.637] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0708, pdwDataLen=0x18e0d0) returned 0 [0038.638] GetLastError () returned 0xea [0038.638] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.638] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.639] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1c3c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1c3c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.640] SetEndOfFile (hFile=0x10c) returned 1 [0038.640] CloseHandle (hObject=0x10c) returned 1 [0038.640] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.640] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.640] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.640] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.640] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa784f6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.640] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.640] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.640] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.640] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sr", cAlternateFileName="")) returned 1 [0038.640] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.641] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.641] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.641] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.641] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.641] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f26b8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f26b8, pdwDataLen=0x18e0d0) returned 0 [0038.641] GetLastError () returned 0xea [0038.641] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f26b8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f26b8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.641] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.642] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1fa8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1fa8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.643] SetEndOfFile (hFile=0x10c) returned 1 [0038.643] CloseHandle (hObject=0x10c) returned 1 [0038.643] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.643] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.643] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.643] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.643] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa784f6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.643] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.643] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.643] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.643] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sv", cAlternateFileName="")) returned 1 [0038.643] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.644] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.644] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.644] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.644] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.644] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1830*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1830, pdwDataLen=0x18e0d0) returned 0 [0038.644] GetLastError () returned 0xea [0038.644] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1830*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1830*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.644] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.645] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2bd0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2bd0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.646] SetEndOfFile (hFile=0x10c) returned 1 [0038.646] CloseHandle (hObject=0x10c) returned 1 [0038.646] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.646] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.646] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.646] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.646] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa784f6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.646] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.646] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.646] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.646] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="th", cAlternateFileName="")) returned 1 [0038.646] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.647] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.647] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.647] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.647] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.647] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0708, pdwDataLen=0x18e0d0) returned 0 [0038.647] GetLastError () returned 0xea [0038.647] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.648] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0970*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0970*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.649] SetEndOfFile (hFile=0x10c) returned 1 [0038.649] CloseHandle (hObject=0x10c) returned 1 [0038.649] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.649] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.649] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.649] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.649] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa784f6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa784f6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa784f6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.649] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.649] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.649] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.649] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="tr", cAlternateFileName="")) returned 1 [0038.649] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.650] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.650] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.650] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.650] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.650] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e0d0) returned 0 [0038.650] GetLastError () returned 0xea [0038.650] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.650] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.654] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1b74*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1b74*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.655] SetEndOfFile (hFile=0x10c) returned 1 [0038.655] CloseHandle (hObject=0x10c) returned 1 [0038.655] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.655] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.655] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7875810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7875810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.655] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7875810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7875810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.655] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7875810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7875810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7875810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.655] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.655] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.655] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="uk", cAlternateFileName="")) returned 1 [0038.656] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.656] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.656] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.656] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.656] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.656] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1da0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1da0, pdwDataLen=0x18e0d0) returned 0 [0038.656] GetLastError () returned 0xea [0038.656] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1da0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1da0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.657] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.657] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2364*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2364*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.658] SetEndOfFile (hFile=0x10c) returned 1 [0038.658] CloseHandle (hObject=0x10c) returned 1 [0038.658] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.658] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.658] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7875810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7875810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.658] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7875810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7875810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.658] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7875810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7875810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7875810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.658] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.658] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.658] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.659] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="vi", cAlternateFileName="")) returned 1 [0038.659] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.659] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.659] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.659] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.659] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.659] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0708, pdwDataLen=0x18e0d0) returned 0 [0038.659] GetLastError () returned 0xea [0038.659] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.660] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.660] WriteFile (in: hFile=0x10c, lpBuffer=0x33e222c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e222c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.661] SetEndOfFile (hFile=0x10c) returned 1 [0038.661] CloseHandle (hObject=0x10c) returned 1 [0038.661] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.661] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.661] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7875810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7875810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.661] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7875810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7875810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.661] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7875810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7875810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7875810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.661] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.661] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.661] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.661] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0038.662] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.662] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.662] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.662] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.662] CryptDestroyHash (hHash=0x5c9080) returned 1 [0038.662] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2d44*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2d44, pdwDataLen=0x18e0d0) returned 0 [0038.662] GetLastError () returned 0xea [0038.662] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2d44*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2d44*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.663] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.663] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0cdc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0cdc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.664] SetEndOfFile (hFile=0x10c) returned 1 [0038.664] CloseHandle (hObject=0x10c) returned 1 [0038.664] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.664] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.664] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7875810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7875810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.664] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7875810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7875810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.664] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7875810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7875810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7875810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.664] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.664] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.665] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.665] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0038.665] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.665] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.665] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.665] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0038.665] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.665] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d80, pdwDataLen=0x18e0d0) returned 0 [0038.665] GetLastError () returned 0xea [0038.666] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d80*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.666] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.667] WriteFile (in: hFile=0x10c, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.668] SetEndOfFile (hFile=0x10c) returned 1 [0038.668] CloseHandle (hObject=0x10c) returned 1 [0038.668] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.668] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.668] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa789b970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa789b970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.668] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa789b970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa789b970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.668] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa789b970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa789b970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa789b970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.668] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.668] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.668] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0038.668] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0038.668] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0038.668] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0038.669] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0038.669] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.669] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c9080) returned 1 [0038.669] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0038.669] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d80, pdwDataLen=0x18e338) returned 0 [0038.669] GetLastError () returned 0xea [0038.669] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d80*, pdwDataLen=0x18e334*=0x260) returned 1 [0038.669] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.670] WriteFile (in: hFile=0x100, lpBuffer=0x33e2094*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33e2094*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0038.673] SetEndOfFile (hFile=0x100) returned 1 [0038.673] CloseHandle (hObject=0x100) returned 1 [0038.673] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.673] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.673] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa789b970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa789b970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.673] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa789b970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa789b970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.673] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa789b970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa789b970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa789b970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.673] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0038.673] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0038.674] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.674] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0038.674] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.674] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76f8a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa771ebb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.674] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa76f8a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa76f8a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa771ebb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.674] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.674] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="blpcfgokakmgnkcojhhkbfbldkacnbeo", cAlternateFileName="BLPCFG~1")) returned 1 [0038.674] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0038.674] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0038.674] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.674] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9180) returned 1 [0038.674] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.675] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e808) returned 0 [0038.675] GetLastError () returned 0xea [0038.675] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e804*=0x260) returned 1 [0038.675] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0038.675] WriteFile (in: hFile=0x104, lpBuffer=0x33f20bc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33f20bc*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0038.676] SetEndOfFile (hFile=0x104) returned 1 [0038.676] CloseHandle (hObject=0x104) returned 1 [0038.676] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.676] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.677] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa789b970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa789b970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.677] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81a42ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa789b970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa789b970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.677] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa23826f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa23826f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 1 [0038.677] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0038.677] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0038.677] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.677] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9080) returned 1 [0038.677] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.677] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1c90*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1c90, pdwDataLen=0x18e5a0) returned 0 [0038.677] GetLastError () returned 0xea [0038.677] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1c90*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1c90*, pdwDataLen=0x18e59c*=0x260) returned 1 [0038.678] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.678] WriteFile (in: hFile=0xfc, lpBuffer=0x33f2ddc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33f2ddc*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0038.679] SetEndOfFile (hFile=0xfc) returned 1 [0038.679] CloseHandle (hObject=0xfc) returned 1 [0038.679] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.679] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.679] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa789b970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa789b970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.679] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa789b970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa789b970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.679] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa23826f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa23826f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa23826f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xd4e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="128.png.crypt", cAlternateFileName="128PNG~1.CRY")) returned 1 [0038.679] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa789b970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa789b970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa789b970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.679] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0038.679] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_locales", cAlternateFileName="")) returned 1 [0038.679] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0038.680] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0038.680] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.680] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c91c0) returned 1 [0038.680] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.680] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07cc*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33e07cc, pdwDataLen=0x18e338) returned 0 [0038.680] GetLastError () returned 0xea [0038.680] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07cc*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33e07cc*, pdwDataLen=0x18e334*=0x260) returned 1 [0038.680] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.682] WriteFile (in: hFile=0x100, lpBuffer=0x33e1c0c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33e1c0c*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0038.683] SetEndOfFile (hFile=0x100) returned 1 [0038.683] CloseHandle (hObject=0x100) returned 1 [0038.683] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0038.683] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0038.683] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.683] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ar", cAlternateFileName="")) returned 1 [0038.683] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.684] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.684] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.684] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.684] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.684] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f29b0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f29b0, pdwDataLen=0x18e0d0) returned 0 [0038.684] GetLastError () returned 0xea [0038.684] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f29b0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f29b0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.684] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.685] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1634*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1634*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.685] SetEndOfFile (hFile=0x10c) returned 1 [0038.686] CloseHandle (hObject=0x10c) returned 1 [0038.686] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.686] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.686] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.686] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78c1ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.686] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.686] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.686] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.686] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="bg", cAlternateFileName="")) returned 1 [0038.686] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.687] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.687] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.687] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.687] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.687] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17cc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17cc, pdwDataLen=0x18e0d0) returned 0 [0038.687] GetLastError () returned 0xea [0038.687] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17cc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17cc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.687] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.688] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2130*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2130*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.688] SetEndOfFile (hFile=0x10c) returned 1 [0038.689] CloseHandle (hObject=0x10c) returned 1 [0038.689] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.689] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.689] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.689] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.689] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78c1ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.689] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.689] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.689] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.689] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ca", cAlternateFileName="")) returned 1 [0038.689] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.690] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.690] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.690] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.690] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.690] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1998*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1998, pdwDataLen=0x18e0d0) returned 0 [0038.690] GetLastError () returned 0xea [0038.690] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1998*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1998*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.690] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.690] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1c00*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1c00*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.691] SetEndOfFile (hFile=0x10c) returned 1 [0038.691] CloseHandle (hObject=0x10c) returned 1 [0038.691] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.692] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.692] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.692] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.692] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78c1ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.692] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.692] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.692] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.692] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="cs", cAlternateFileName="")) returned 1 [0038.692] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.693] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.693] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.693] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.693] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.693] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07f4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e07f4, pdwDataLen=0x18e0d0) returned 0 [0038.693] GetLastError () returned 0xea [0038.693] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07f4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e07f4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.693] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.693] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2dac*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2dac*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.694] SetEndOfFile (hFile=0x10c) returned 1 [0038.694] CloseHandle (hObject=0x10c) returned 1 [0038.694] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.694] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.695] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.695] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.695] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78c1ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.695] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.695] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.695] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.695] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="da", cAlternateFileName="")) returned 1 [0038.695] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.695] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.696] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.696] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.696] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.696] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e18e0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e18e0, pdwDataLen=0x18e0d0) returned 0 [0038.696] GetLastError () returned 0xea [0038.696] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e18e0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e18e0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.696] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.696] WriteFile (in: hFile=0x10c, lpBuffer=0x33e07ac*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e07ac*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.698] SetEndOfFile (hFile=0x10c) returned 1 [0038.698] CloseHandle (hObject=0x10c) returned 1 [0038.698] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.698] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.698] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.698] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.698] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78c1ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.698] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.698] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.698] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.698] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="de", cAlternateFileName="")) returned 1 [0038.698] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.699] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.699] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.699] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.699] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.699] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07c4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e07c4, pdwDataLen=0x18e0d0) returned 0 [0038.699] GetLastError () returned 0xea [0038.699] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07c4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e07c4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.699] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.700] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2978*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2978*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.701] SetEndOfFile (hFile=0x10c) returned 1 [0038.701] CloseHandle (hObject=0x10c) returned 1 [0038.701] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.701] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.701] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.701] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78e7c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.701] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.701] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.701] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.701] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="el", cAlternateFileName="")) returned 1 [0038.701] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.702] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.702] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.702] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.702] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.702] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17bc, pdwDataLen=0x18e0d0) returned 0 [0038.702] GetLastError () returned 0xea [0038.702] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.702] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.703] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.704] SetEndOfFile (hFile=0x10c) returned 1 [0038.704] CloseHandle (hObject=0x10c) returned 1 [0038.704] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.704] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.704] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.704] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.704] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78e7c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.704] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.704] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.704] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.704] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85217f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85217f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en", cAlternateFileName="")) returned 1 [0038.704] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.705] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.705] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.705] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.705] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.705] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0038.705] GetLastError () returned 0xea [0038.705] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.705] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.706] WriteFile (in: hFile=0x10c, lpBuffer=0x33f285c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f285c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.707] SetEndOfFile (hFile=0x10c) returned 1 [0038.707] CloseHandle (hObject=0x10c) returned 1 [0038.707] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.707] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.707] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.707] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78e7c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.707] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.707] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85218f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.707] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.707] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es", cAlternateFileName="")) returned 1 [0038.707] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.708] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.708] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.708] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.708] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.708] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d88*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d88, pdwDataLen=0x18e0d0) returned 0 [0038.708] GetLastError () returned 0xea [0038.708] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d88*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d88*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.709] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1ff0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1ff0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.710] SetEndOfFile (hFile=0x10c) returned 1 [0038.710] CloseHandle (hObject=0x10c) returned 1 [0038.710] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.710] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.710] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.710] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85217f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.710] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78e7c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.710] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.710] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.710] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.710] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fi", cAlternateFileName="")) returned 1 [0038.710] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.711] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.711] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.711] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.711] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.711] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d78*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d78, pdwDataLen=0x18e0d0) returned 0 [0038.711] GetLastError () returned 0xea [0038.711] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d78*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d78*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.711] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.712] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2aec*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2aec*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.713] SetEndOfFile (hFile=0x10c) returned 1 [0038.713] CloseHandle (hObject=0x10c) returned 1 [0038.713] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.713] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.713] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78e7c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.713] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78e7c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78e7c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa790dd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.713] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.713] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.713] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.713] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fil", cAlternateFileName="")) returned 1 [0038.713] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.714] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.714] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.714] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.714] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.714] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0ebc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0ebc, pdwDataLen=0x18e0d0) returned 0 [0038.714] GetLastError () returned 0xea [0038.714] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0ebc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0ebc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.714] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.715] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1c30*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1c30*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.716] SetEndOfFile (hFile=0x10c) returned 1 [0038.716] CloseHandle (hObject=0x10c) returned 1 [0038.716] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.716] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.716] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa790dd90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa790dd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.716] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa790dd90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa790dd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.716] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa790dd90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa790dd90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa790dd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.716] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.716] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.716] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.716] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fr", cAlternateFileName="")) returned 1 [0038.716] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.717] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.717] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.717] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.717] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.717] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22b8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f22b8, pdwDataLen=0x18e0d0) returned 0 [0038.717] GetLastError () returned 0xea [0038.717] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22b8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f22b8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.717] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.718] WriteFile (in: hFile=0x10c, lpBuffer=0x33e17cc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e17cc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.719] SetEndOfFile (hFile=0x10c) returned 1 [0038.719] CloseHandle (hObject=0x10c) returned 1 [0038.719] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.719] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa790dd90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa790dd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.719] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa790dd90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa790dd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.719] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa790dd90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa790dd90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa790dd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.719] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.719] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.719] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.719] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="he", cAlternateFileName="")) returned 1 [0038.719] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.720] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.720] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.720] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.720] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.720] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e17f4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e17f4, pdwDataLen=0x18e0d0) returned 0 [0038.720] GetLastError () returned 0xea [0038.720] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e17f4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e17f4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.720] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.721] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.722] SetEndOfFile (hFile=0x10c) returned 1 [0038.723] CloseHandle (hObject=0x10c) returned 1 [0038.723] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.723] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.723] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa790dd90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa790dd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.723] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa790dd90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa790dd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.723] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa790dd90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa790dd90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa790dd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.723] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.723] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.723] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.723] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523e0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8523e0d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hi", cAlternateFileName="")) returned 1 [0038.723] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.724] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.724] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.724] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.724] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.724] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07e4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e07e4, pdwDataLen=0x18e0d0) returned 0 [0038.724] GetLastError () returned 0xea [0038.724] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07e4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e07e4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.724] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.725] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0dc8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0dc8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.726] SetEndOfFile (hFile=0x10c) returned 1 [0038.726] CloseHandle (hObject=0x10c) returned 1 [0038.726] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.726] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.726] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa790dd90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa790dd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.726] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa790dd90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa790dd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.726] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa790dd90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa790dd90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa790dd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.726] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.726] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8523e0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8523d900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.726] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.727] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa78c1ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa78c1ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa78c1ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.727] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hr", cAlternateFileName="")) returned 1 [0038.727] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.727] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.727] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.727] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.727] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.727] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b08*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1b08, pdwDataLen=0x18e0d0) returned 0 [0038.727] GetLastError () returned 0xea [0038.727] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b08*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1b08*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.728] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.728] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0e10*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0e10*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.729] SetEndOfFile (hFile=0x10c) returned 1 [0038.729] CloseHandle (hObject=0x10c) returned 1 [0038.729] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.729] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.729] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.729] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.729] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7933ef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.729] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.729] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.729] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.729] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hu", cAlternateFileName="")) returned 1 [0038.730] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.730] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.730] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.730] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.730] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.730] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07d4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e07d4, pdwDataLen=0x18e0d0) returned 0 [0038.730] GetLastError () returned 0xea [0038.730] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07d4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e07d4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.730] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.731] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1124*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1124*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.732] SetEndOfFile (hFile=0x10c) returned 1 [0038.732] CloseHandle (hObject=0x10c) returned 1 [0038.732] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.732] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.732] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.733] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.733] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7933ef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.733] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.733] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.733] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.733] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="id", cAlternateFileName="")) returned 1 [0038.733] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.733] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.733] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.733] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.733] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.733] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c20*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2c20, pdwDataLen=0x18e0d0) returned 0 [0038.734] GetLastError () returned 0xea [0038.734] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c20*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2c20*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.734] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.735] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1604*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1604*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.736] SetEndOfFile (hFile=0x10c) returned 1 [0038.736] CloseHandle (hObject=0x10c) returned 1 [0038.736] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.736] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.736] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.736] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.736] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7933ef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.736] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.736] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.736] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.736] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="it", cAlternateFileName="")) returned 1 [0038.736] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.737] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.737] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.737] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.737] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.737] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c10*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2c10, pdwDataLen=0x18e0d0) returned 0 [0038.737] GetLastError () returned 0xea [0038.737] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c10*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2c10*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.737] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.738] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2120*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2120*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.739] SetEndOfFile (hFile=0x10c) returned 1 [0038.739] CloseHandle (hObject=0x10c) returned 1 [0038.739] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.739] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.739] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.739] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.739] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7933ef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.739] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.739] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.739] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.739] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ja", cAlternateFileName="")) returned 1 [0038.739] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.740] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.740] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.740] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.740] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.740] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b28*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1b28, pdwDataLen=0x18e0d0) returned 0 [0038.740] GetLastError () returned 0xea [0038.740] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b28*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1b28*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.740] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.741] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2c18*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2c18*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.742] SetEndOfFile (hFile=0x10c) returned 1 [0038.742] CloseHandle (hObject=0x10c) returned 1 [0038.742] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.742] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.742] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.742] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.742] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7933ef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7933ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7933ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.742] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.742] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.742] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.742] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85264230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ko", cAlternateFileName="")) returned 1 [0038.742] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.743] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.743] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.743] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.743] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.743] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07d4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e07d4, pdwDataLen=0x18e0d0) returned 0 [0038.743] GetLastError () returned 0xea [0038.743] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07d4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e07d4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.744] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.744] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1c04*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1c04*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.745] SetEndOfFile (hFile=0x10c) returned 1 [0038.745] CloseHandle (hObject=0x10c) returned 1 [0038.745] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.745] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.745] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.745] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.745] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa795a050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.745] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.745] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85264230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85264a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.745] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.745] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lt", cAlternateFileName="")) returned 1 [0038.745] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.746] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.746] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.746] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.746] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.746] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f6c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2f6c, pdwDataLen=0x18e0d0) returned 0 [0038.746] GetLastError () returned 0xea [0038.746] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f6c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2f6c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.746] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.747] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1c24*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1c24*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.749] SetEndOfFile (hFile=0x10c) returned 1 [0038.749] CloseHandle (hObject=0x10c) returned 1 [0038.749] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.749] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.749] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.749] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa795a050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.749] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.749] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.749] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.749] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lv", cAlternateFileName="")) returned 1 [0038.749] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.750] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.750] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.750] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.750] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.750] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22d8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f22d8, pdwDataLen=0x18e0d0) returned 0 [0038.750] GetLastError () returned 0xea [0038.750] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22d8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f22d8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.751] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1990*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1990*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.752] SetEndOfFile (hFile=0x10c) returned 1 [0038.752] CloseHandle (hObject=0x10c) returned 1 [0038.752] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.752] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.752] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.752] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.752] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa795a050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.752] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.752] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.752] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.752] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="nl", cAlternateFileName="")) returned 1 [0038.752] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.753] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.753] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.753] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.753] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.753] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17bc, pdwDataLen=0x18e0d0) returned 0 [0038.753] GetLastError () returned 0xea [0038.753] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.753] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.754] WriteFile (in: hFile=0x10c, lpBuffer=0x33f21d4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f21d4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.755] SetEndOfFile (hFile=0x10c) returned 1 [0038.755] CloseHandle (hObject=0x10c) returned 1 [0038.755] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.755] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.755] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.755] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa795a050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.755] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.755] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.755] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="no", cAlternateFileName="")) returned 1 [0038.755] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.756] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.756] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.756] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.756] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.756] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a3c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1a3c, pdwDataLen=0x18e0d0) returned 0 [0038.756] GetLastError () returned 0xea [0038.756] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a3c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1a3c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.757] WriteFile (in: hFile=0x10c, lpBuffer=0x33f27e0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f27e0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.757] SetEndOfFile (hFile=0x10c) returned 1 [0038.758] CloseHandle (hObject=0x10c) returned 1 [0038.758] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.758] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.758] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.758] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa795a050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa795a050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa795a050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.758] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.758] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c12fb00, ftLastWriteTime.dwHighDateTime=0x1d0f3ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.758] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.758] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8528a390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8528a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pl", cAlternateFileName="")) returned 1 [0038.758] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.759] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.759] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.759] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.759] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.759] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0b40*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0b40, pdwDataLen=0x18e0d0) returned 0 [0038.759] GetLastError () returned 0xea [0038.759] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0b40*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0b40*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.760] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2b5c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2b5c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.761] SetEndOfFile (hFile=0x10c) returned 1 [0038.761] CloseHandle (hObject=0x10c) returned 1 [0038.761] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.761] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.761] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.762] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.762] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79801b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.762] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.762] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852893f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.762] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.762] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0038.762] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.762] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.762] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.762] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.762] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.762] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0de8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0de8, pdwDataLen=0x18e0d0) returned 0 [0038.762] GetLastError () returned 0xea [0038.763] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0de8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0de8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.763] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.764] SetEndOfFile (hFile=0x10c) returned 1 [0038.764] CloseHandle (hObject=0x10c) returned 1 [0038.764] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.764] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.764] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.765] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8528a390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.765] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79801b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.765] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.765] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.765] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.765] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0038.765] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.765] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.765] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.765] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.765] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.765] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22dc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f22dc, pdwDataLen=0x18e0d0) returned 0 [0038.765] GetLastError () returned 0xea [0038.765] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22dc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f22dc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.766] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.766] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1c24*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1c24*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.767] SetEndOfFile (hFile=0x10c) returned 1 [0038.767] CloseHandle (hObject=0x10c) returned 1 [0038.767] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.767] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.767] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.768] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.768] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79801b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.768] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.768] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.768] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.768] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ro", cAlternateFileName="")) returned 1 [0038.768] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.768] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.768] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.769] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.769] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.769] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17bc, pdwDataLen=0x18e0d0) returned 0 [0038.769] GetLastError () returned 0xea [0038.769] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.769] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.769] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1fa4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1fa4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.770] SetEndOfFile (hFile=0x10c) returned 1 [0038.770] CloseHandle (hObject=0x10c) returned 1 [0038.770] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.770] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.770] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.771] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.771] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79801b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.771] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.771] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.771] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.771] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ru", cAlternateFileName="")) returned 1 [0038.771] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.771] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.771] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.771] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.771] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.772] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07b4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e07b4, pdwDataLen=0x18e0d0) returned 0 [0038.772] GetLastError () returned 0xea [0038.772] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07b4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e07b4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.772] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.773] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2d00*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2d00*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.774] SetEndOfFile (hFile=0x10c) returned 1 [0038.774] CloseHandle (hObject=0x10c) returned 1 [0038.774] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.774] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.774] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.788] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.791] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79801b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa79801b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79801b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.791] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.794] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.794] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.794] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sk", cAlternateFileName="")) returned 1 [0038.796] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.801] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.801] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.801] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.802] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.802] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1c80*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1c80, pdwDataLen=0x18e0d0) returned 0 [0038.802] GetLastError () returned 0xea [0038.802] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1c80*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1c80*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.802] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.803] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0af8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0af8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.803] SetEndOfFile (hFile=0x10c) returned 1 [0038.804] CloseHandle (hObject=0x10c) returned 1 [0038.804] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.804] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.804] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79cc470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79cc470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.804] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79cc470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79cc470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.804] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79cc470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa79cc470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79cc470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.804] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.804] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.804] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.804] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852b04f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sl", cAlternateFileName="")) returned 1 [0038.804] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.805] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.805] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.805] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.805] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.805] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0b10*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0b10, pdwDataLen=0x18e0d0) returned 0 [0038.805] GetLastError () returned 0xea [0038.805] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0b10*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0b10*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.805] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.806] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2a70*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2a70*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.807] SetEndOfFile (hFile=0x10c) returned 1 [0038.807] CloseHandle (hObject=0x10c) returned 1 [0038.807] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.807] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.807] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79cc470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79cc470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.807] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79cc470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79cc470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.807] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79cc470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa79cc470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79f25d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.807] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.807] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852b04f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852b04f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.807] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.807] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sr", cAlternateFileName="")) returned 1 [0038.807] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.808] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.808] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.808] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.808] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.808] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0d90*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0d90, pdwDataLen=0x18e0d0) returned 0 [0038.808] GetLastError () returned 0xea [0038.808] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0d90*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0d90*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.808] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.809] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1af4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1af4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.810] SetEndOfFile (hFile=0x10c) returned 1 [0038.810] CloseHandle (hObject=0x10c) returned 1 [0038.810] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.810] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.810] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79f25d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79f25d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.810] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79f25d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79f25d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.810] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79f25d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa79f25d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79f25d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.810] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.810] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.810] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.810] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sv", cAlternateFileName="")) returned 1 [0038.810] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.811] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.811] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.811] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.811] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.811] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e136c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e136c, pdwDataLen=0x18e0d0) returned 0 [0038.811] GetLastError () returned 0xea [0038.811] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e136c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e136c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.811] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.813] WriteFile (in: hFile=0x10c, lpBuffer=0x33e15d4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e15d4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.814] SetEndOfFile (hFile=0x10c) returned 1 [0038.814] CloseHandle (hObject=0x10c) returned 1 [0038.814] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.814] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.814] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79f25d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79f25d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.814] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79f25d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79f25d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.814] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79f25d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa79f25d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79f25d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.814] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.814] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.814] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.814] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="th", cAlternateFileName="")) returned 1 [0038.814] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.815] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.815] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.815] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.815] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.815] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e135c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e135c, pdwDataLen=0x18e0d0) returned 0 [0038.815] GetLastError () returned 0xea [0038.815] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e135c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e135c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.815] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.816] WriteFile (in: hFile=0x10c, lpBuffer=0x33e20c0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e20c0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.817] SetEndOfFile (hFile=0x10c) returned 1 [0038.817] CloseHandle (hObject=0x10c) returned 1 [0038.817] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.817] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.817] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79f25d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79f25d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.817] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79f25d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79f25d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.817] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79f25d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa79f25d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79f25d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.817] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.817] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.817] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.817] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="tr", cAlternateFileName="")) returned 1 [0038.817] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.818] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.818] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.818] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.818] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.818] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b48*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1b48, pdwDataLen=0x18e0d0) returned 0 [0038.818] GetLastError () returned 0xea [0038.818] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b48*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1b48*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.818] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.819] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2760*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2760*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.820] SetEndOfFile (hFile=0x10c) returned 1 [0038.820] CloseHandle (hObject=0x10c) returned 1 [0038.820] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.820] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.820] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79f25d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79f25d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.820] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa79f25d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79f25d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.820] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79f25d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa79f25d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa79f25d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.820] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.820] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.820] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.820] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="uk", cAlternateFileName="")) returned 1 [0038.820] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.821] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.821] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.821] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.821] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.821] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2128*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2128, pdwDataLen=0x18e0d0) returned 0 [0038.821] GetLastError () returned 0xea [0038.821] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2128*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2128*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.821] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.822] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03b4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03b4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.823] SetEndOfFile (hFile=0x10c) returned 1 [0038.823] CloseHandle (hObject=0x10c) returned 1 [0038.823] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.823] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.823] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a18730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a18730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.823] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a18730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a18730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.823] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a18730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a18730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a18730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.823] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.823] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.823] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.823] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d6650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x852d6650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="vi", cAlternateFileName="")) returned 1 [0038.823] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.824] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.824] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.824] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.824] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.824] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2118*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2118, pdwDataLen=0x18e0d0) returned 0 [0038.824] GetLastError () returned 0xea [0038.824] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2118*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2118*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.824] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.830] WriteFile (in: hFile=0x10c, lpBuffer=0x33e07bc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e07bc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.831] SetEndOfFile (hFile=0x10c) returned 1 [0038.831] CloseHandle (hObject=0x10c) returned 1 [0038.831] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.832] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.832] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a18730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a18730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.832] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a18730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a18730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.832] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a18730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a18730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a18730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.832] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.832] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x852d6650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x852d75f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.832] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.832] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0038.832] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.833] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.833] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.833] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.833] CryptDestroyHash (hHash=0x5c9200) returned 1 [0038.833] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07dc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e07dc, pdwDataLen=0x18e0d0) returned 0 [0038.833] GetLastError () returned 0xea [0038.833] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07dc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e07dc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.833] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.834] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03e4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03e4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.835] SetEndOfFile (hFile=0x10c) returned 1 [0038.835] CloseHandle (hObject=0x10c) returned 1 [0038.835] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.835] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a18730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a18730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.835] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a18730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a18730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.835] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a18730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a18730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a18730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.835] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.835] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.835] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.835] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0038.835] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.836] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.836] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.836] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9200) returned 1 [0038.836] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.836] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17c0, pdwDataLen=0x18e0d0) returned 0 [0038.836] GetLastError () returned 0xea [0038.836] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.836] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.837] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1a8c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1a8c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.838] SetEndOfFile (hFile=0x10c) returned 1 [0038.838] CloseHandle (hObject=0x10c) returned 1 [0038.838] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.838] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a18730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a18730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.838] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a18730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a18730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.838] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a18730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a18730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.838] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.838] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.838] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.838] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0038.839] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0038.839] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0038.839] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0038.839] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0038.839] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.839] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c9200) returned 1 [0038.839] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0038.839] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1314*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33e1314, pdwDataLen=0x18e338) returned 0 [0038.839] GetLastError () returned 0xea [0038.839] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1314*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33e1314*, pdwDataLen=0x18e334*=0x260) returned 1 [0038.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.840] WriteFile (in: hFile=0x100, lpBuffer=0x33f2dac*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33f2dac*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0038.841] SetEndOfFile (hFile=0x100) returned 1 [0038.841] CloseHandle (hObject=0x100) returned 1 [0038.841] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.841] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.841] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.841] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a3e890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.841] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0038.841] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85347ad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x628aed00, ftLastWriteTime.dwHighDateTime=0x1d0f5b2, nFileSizeHigh=0x0, nFileSizeLow=0x2769, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0038.841] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0038.841] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85348a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85348a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85348a70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0038.842] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0038.842] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa789b970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa789b970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa789b970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.842] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa789b970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa789b970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa789b970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0038.842] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.842] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844c0700, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844c0700, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="felcaaldnbdncclmgdcncolpebgiejap", cAlternateFileName="FELCAA~1")) returned 1 [0038.842] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0038.842] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0038.842] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.842] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9080) returned 1 [0038.842] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.842] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2604*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33f2604, pdwDataLen=0x18e808) returned 0 [0038.842] GetLastError () returned 0xea [0038.842] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2604*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33f2604*, pdwDataLen=0x18e804*=0x260) returned 1 [0038.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0038.843] WriteFile (in: hFile=0x104, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0038.844] SetEndOfFile (hFile=0x104) returned 1 [0038.844] CloseHandle (hObject=0x104) returned 1 [0038.844] CryptDestroyKey (hKey=0x5c9080) returned 1 [0038.844] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0038.844] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x844bb8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.844] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa23f4b10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa23f4b10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1.1_0", cAlternateFileName="")) returned 1 [0038.844] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0038.845] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0038.845] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.845] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9200) returned 1 [0038.845] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.845] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e5a0) returned 0 [0038.845] GetLastError () returned 0xea [0038.845] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e59c*=0x260) returned 1 [0038.845] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0038.846] WriteFile (in: hFile=0xfc, lpBuffer=0x33f1d60*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33f1d60*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0038.847] SetEndOfFile (hFile=0xfc) returned 1 [0038.847] CloseHandle (hObject=0xfc) returned 1 [0038.847] CryptDestroyKey (hKey=0x5c9200) returned 1 [0038.847] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.847] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0038.847] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8401b790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.847] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a3e890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.847] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa23f4b10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa23f4b10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa23f4b10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xd47, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="icon_128.png.crypt", cAlternateFileName="ICON_1~1.CRY")) returned 1 [0038.847] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa23f4b10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa23f4b10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa23f4b10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="icon_16.png.crypt", cAlternateFileName="ICON_1~2.CRY")) returned 1 [0038.847] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8423be80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8423e590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="main.html", cAlternateFileName="MAIN~1.HTM")) returned 1 [0038.847] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84240ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84240ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x5f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="main.js", cAlternateFileName="")) returned 1 [0038.847] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x840205b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84245ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844aa770, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0038.847] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422fb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422fb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_locales", cAlternateFileName="")) returned 1 [0038.847] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0038.848] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0038.848] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.848] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c91c0) returned 1 [0038.848] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.848] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f00a4*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f00a4, pdwDataLen=0x18e338) returned 0 [0038.848] GetLastError () returned 0xea [0038.848] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f00a4*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f00a4*, pdwDataLen=0x18e334*=0x260) returned 1 [0038.848] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0038.849] WriteFile (in: hFile=0x100, lpBuffer=0x33e1d28*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33e1d28*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0038.850] SetEndOfFile (hFile=0x100) returned 1 [0038.851] CloseHandle (hObject=0x100) returned 1 [0038.851] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0038.851] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.851] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0038.851] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8402f010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.851] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8403b360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ar", cAlternateFileName="")) returned 1 [0038.851] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.851] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.851] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.851] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.852] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.852] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f008c, pdwDataLen=0x18e0d0) returned 0 [0038.852] GetLastError () returned 0xea [0038.852] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.852] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2094*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2094*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.853] SetEndOfFile (hFile=0x10c) returned 1 [0038.854] CloseHandle (hObject=0x10c) returned 1 [0038.854] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.854] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.854] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.854] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84036540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.854] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a3e890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.854] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.854] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8403b360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8403b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.854] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.854] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84056110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84056110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="bg", cAlternateFileName="")) returned 1 [0038.854] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.855] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.855] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.855] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.855] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.855] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f008c, pdwDataLen=0x18e0d0) returned 0 [0038.855] GetLastError () returned 0xea [0038.855] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.856] WriteFile (in: hFile=0x10c, lpBuffer=0x33f25fc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f25fc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.857] SetEndOfFile (hFile=0x10c) returned 1 [0038.857] CloseHandle (hObject=0x10c) returned 1 [0038.857] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.857] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.857] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.857] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x840512f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.857] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a649f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.857] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.857] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84056110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84058820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.857] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.857] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84067280, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ca", cAlternateFileName="")) returned 1 [0038.857] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.858] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.858] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.858] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.858] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.858] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f008c, pdwDataLen=0x18e0d0) returned 0 [0038.858] GetLastError () returned 0xea [0038.858] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.858] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.859] WriteFile (in: hFile=0x10c, lpBuffer=0x33f25fc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f25fc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.860] SetEndOfFile (hFile=0x10c) returned 1 [0038.860] CloseHandle (hObject=0x10c) returned 1 [0038.860] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.860] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.860] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.860] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84062460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.860] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a649f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.860] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.860] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84067280, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84067280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.860] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.860] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8407f920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8407f920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="cs", cAlternateFileName="")) returned 1 [0038.860] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.861] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.861] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.861] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.861] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.861] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f008c, pdwDataLen=0x18e0d0) returned 0 [0038.861] GetLastError () returned 0xea [0038.861] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.861] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.862] WriteFile (in: hFile=0x10c, lpBuffer=0x33e06f0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e06f0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.863] SetEndOfFile (hFile=0x10c) returned 1 [0038.863] CloseHandle (hObject=0x10c) returned 1 [0038.863] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.863] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.863] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.863] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8406e7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.863] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a649f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.863] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.863] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8407f920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84082030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.863] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.863] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84090a90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="da", cAlternateFileName="")) returned 1 [0038.863] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.864] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.864] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.864] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.864] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.864] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f008c, pdwDataLen=0x18e0d0) returned 0 [0038.864] GetLastError () returned 0xea [0038.864] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.864] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.865] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1904*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1904*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.866] SetEndOfFile (hFile=0x10c) returned 1 [0038.866] CloseHandle (hObject=0x10c) returned 1 [0038.866] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.866] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.866] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.866] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8408bc70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.866] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a649f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.866] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.866] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84090a90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84090a90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.866] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.867] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8409cde0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="de", cAlternateFileName="")) returned 1 [0038.867] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.867] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.867] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.867] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.867] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.867] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f008c, pdwDataLen=0x18e0d0) returned 0 [0038.867] GetLastError () returned 0xea [0038.867] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.868] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.869] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1b20*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1b20*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.869] SetEndOfFile (hFile=0x10c) returned 1 [0038.870] CloseHandle (hObject=0x10c) returned 1 [0038.870] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.870] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.870] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.870] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84097fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a649f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.870] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a649f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a649f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a8ab50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.870] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.870] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8409cde0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8409cde0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b1ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.870] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.870] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84116f00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="el", cAlternateFileName="")) returned 1 [0038.870] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.871] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.871] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.871] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.871] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.871] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f008c, pdwDataLen=0x18e0d0) returned 0 [0038.871] GetLastError () returned 0xea [0038.871] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.871] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.872] WriteFile (in: hFile=0x10c, lpBuffer=0x33f22e0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f22e0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.873] SetEndOfFile (hFile=0x10c) returned 1 [0038.873] CloseHandle (hObject=0x10c) returned 1 [0038.873] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.873] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.873] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a8ab50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a8ab50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.873] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841147f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a8ab50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a8ab50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.873] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a8ab50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a8ab50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a8ab50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.874] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.874] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84116f00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84116f00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.874] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.874] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84120b40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en_GB", cAlternateFileName="")) returned 1 [0038.874] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.874] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.874] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.874] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.874] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.874] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e121c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e121c, pdwDataLen=0x18e0d0) returned 0 [0038.874] GetLastError () returned 0xea [0038.874] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e121c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e121c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.875] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.875] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2ddc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2ddc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.876] SetEndOfFile (hFile=0x10c) returned 1 [0038.876] CloseHandle (hObject=0x10c) returned 1 [0038.876] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.876] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.876] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a8ab50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a8ab50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.877] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8411bd20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a8ab50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a8ab50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.877] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a8ab50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a8ab50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a8ab50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.877] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.877] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84120b40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84120b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.877] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.877] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8412ce90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en_US", cAlternateFileName="")) returned 1 [0038.877] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.877] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.877] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.877] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.877] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.878] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e0d0) returned 0 [0038.878] GetLastError () returned 0xea [0038.878] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.878] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.878] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1b74*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1b74*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.879] SetEndOfFile (hFile=0x10c) returned 1 [0038.879] CloseHandle (hObject=0x10c) returned 1 [0038.879] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.879] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.879] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a8ab50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a8ab50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.880] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8412a780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a8ab50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a8ab50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.880] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a8ab50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a8ab50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a8ab50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.880] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.880] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8412ce90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8412ce90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.880] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.880] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841343c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es", cAlternateFileName="")) returned 1 [0038.880] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.881] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.881] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.881] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.881] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.881] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f266c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f266c, pdwDataLen=0x18e0d0) returned 0 [0038.881] GetLastError () returned 0xea [0038.881] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f266c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f266c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.881] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0084*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0084*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.882] SetEndOfFile (hFile=0x10c) returned 1 [0038.883] CloseHandle (hObject=0x10c) returned 1 [0038.883] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.883] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.883] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a8ab50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a8ab50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.883] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84131cb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7a8ab50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a8ab50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.883] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a8ab50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a8ab50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a8ab50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.883] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.883] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841343c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841343c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.883] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.883] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8413b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es_419", cAlternateFileName="")) returned 1 [0038.883] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.884] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.884] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.884] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.884] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.884] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0038.884] GetLastError () returned 0xea [0038.884] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.884] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.885] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1da0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1da0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.886] SetEndOfFile (hFile=0x10c) returned 1 [0038.886] CloseHandle (hObject=0x10c) returned 1 [0038.886] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.886] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.886] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.886] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841391e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.886] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7ab0cb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.886] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.886] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8413b8f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8413b8f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.886] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.887] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84142e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="et", cAlternateFileName="")) returned 1 [0038.887] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.887] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.887] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.887] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.887] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.887] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e125c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e125c, pdwDataLen=0x18e0d0) returned 0 [0038.887] GetLastError () returned 0xea [0038.887] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e125c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e125c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.888] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.888] WriteFile (in: hFile=0x10c, lpBuffer=0x33e14c4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e14c4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.889] SetEndOfFile (hFile=0x10c) returned 1 [0038.889] CloseHandle (hObject=0x10c) returned 1 [0038.889] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.889] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.889] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.889] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84140710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.889] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7ab0cb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.890] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.890] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84142e20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84142e20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.890] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.890] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414a350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8414a350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fi", cAlternateFileName="")) returned 1 [0038.890] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.890] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.890] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.890] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.890] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.890] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e0d0) returned 0 [0038.890] GetLastError () returned 0xea [0038.891] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.891] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.891] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2c80*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2c80*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.892] SetEndOfFile (hFile=0x10c) returned 1 [0038.892] CloseHandle (hObject=0x10c) returned 1 [0038.893] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.893] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.893] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84147c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.893] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7ab0cb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.893] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.893] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8414a350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8414f170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.893] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.893] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841566a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fil", cAlternateFileName="")) returned 1 [0038.893] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.894] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.894] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.894] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.894] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.894] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c98*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2c98, pdwDataLen=0x18e0d0) returned 0 [0038.894] GetLastError () returned 0xea [0038.894] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c98*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2c98*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.894] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.895] WriteFile (in: hFile=0x10c, lpBuffer=0x33e06f0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e06f0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.896] SetEndOfFile (hFile=0x10c) returned 1 [0038.896] CloseHandle (hObject=0x10c) returned 1 [0038.896] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.896] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.896] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84153f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.896] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7ab0cb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.896] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.896] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841566a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841566a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.896] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.896] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8415dbd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fr", cAlternateFileName="")) returned 1 [0038.896] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.897] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.897] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.897] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.897] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.897] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17dc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17dc, pdwDataLen=0x18e0d0) returned 0 [0038.897] GetLastError () returned 0xea [0038.897] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17dc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17dc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.897] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.898] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1d90*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1d90*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.899] SetEndOfFile (hFile=0x10c) returned 1 [0038.899] CloseHandle (hObject=0x10c) returned 1 [0038.900] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.900] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.900] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8415b4c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ab0cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.900] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7ab0cb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7ab0cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ad6e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.900] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.900] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8415dbd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8415dbd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.900] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.900] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84165100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="he", cAlternateFileName="")) returned 1 [0038.900] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.901] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.901] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.901] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.901] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.901] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1540*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1540, pdwDataLen=0x18e0d0) returned 0 [0038.901] GetLastError () returned 0xea [0038.901] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1540*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1540*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.901] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.902] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2570*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2570*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.903] SetEndOfFile (hFile=0x10c) returned 1 [0038.903] CloseHandle (hObject=0x10c) returned 1 [0038.903] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.903] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ad6e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ad6e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.903] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841629f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ad6e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ad6e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.903] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7ad6e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7ad6e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ad6e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.903] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.903] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84165100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84165100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.903] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.904] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8416c630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hi", cAlternateFileName="")) returned 1 [0038.904] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.904] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.904] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.904] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.904] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.904] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0a44*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0a44, pdwDataLen=0x18e0d0) returned 0 [0038.904] GetLastError () returned 0xea [0038.904] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0a44*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0a44*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.905] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.905] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0ff8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0ff8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.906] SetEndOfFile (hFile=0x10c) returned 1 [0038.906] CloseHandle (hObject=0x10c) returned 1 [0038.906] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.906] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ad6e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ad6e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.907] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84169f20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ad6e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ad6e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.907] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7ad6e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7ad6e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ad6e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.907] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.907] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8416c630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8416c630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.907] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.907] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a3e890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.907] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84173b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hu", cAlternateFileName="")) returned 1 [0038.907] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.907] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.908] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.908] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.908] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.908] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17cc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17cc, pdwDataLen=0x18e0d0) returned 0 [0038.908] GetLastError () returned 0xea [0038.908] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17cc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17cc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.909] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2ce0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2ce0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.910] SetEndOfFile (hFile=0x10c) returned 1 [0038.910] CloseHandle (hObject=0x10c) returned 1 [0038.910] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.910] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.910] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ad6e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ad6e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.910] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84171450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ad6e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ad6e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.910] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7ad6e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7ad6e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ad6e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.910] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.910] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84173b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84173b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.910] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.910] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8417b090, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="id", cAlternateFileName="")) returned 1 [0038.910] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.911] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.911] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.911] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.911] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.911] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2558*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2558, pdwDataLen=0x18e0d0) returned 0 [0038.911] GetLastError () returned 0xea [0038.911] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2558*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2558*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.911] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.912] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0084*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0084*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.913] SetEndOfFile (hFile=0x10c) returned 1 [0038.913] CloseHandle (hObject=0x10c) returned 1 [0038.913] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.913] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.913] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ad6e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ad6e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.913] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84176270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7ad6e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ad6e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.913] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7ad6e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7ad6e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7ad6e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.913] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.913] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8417b090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8417b090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.913] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.913] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841825c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="it", cAlternateFileName="")) returned 1 [0038.914] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.914] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.914] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.914] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.914] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.914] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0038.914] GetLastError () returned 0xea [0038.914] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.915] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.916] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1d70*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1d70*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.917] SetEndOfFile (hFile=0x10c) returned 1 [0038.917] CloseHandle (hObject=0x10c) returned 1 [0038.917] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.917] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.917] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7afcf70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7afcf70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.918] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8417feb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7afcf70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7afcf70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.918] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7afcf70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7afcf70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7afcf70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.918] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.918] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841825c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841825c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.918] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.918] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84189af0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ja", cAlternateFileName="")) returned 1 [0038.918] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.919] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.919] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.919] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.919] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.919] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0aa4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0aa4, pdwDataLen=0x18e0d0) returned 0 [0038.919] GetLastError () returned 0xea [0038.919] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0aa4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0aa4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.919] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.920] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2418*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2418*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.921] SetEndOfFile (hFile=0x10c) returned 1 [0038.921] CloseHandle (hObject=0x10c) returned 1 [0038.922] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.922] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.922] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7afcf70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7afcf70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.922] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841873e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7afcf70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7afcf70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.922] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7afcf70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7afcf70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7afcf70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.922] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.922] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84189af0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84189af0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b43b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.922] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.922] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84191020, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ko", cAlternateFileName="")) returned 1 [0038.922] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.923] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.923] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.923] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.923] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.923] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1e64*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1e64, pdwDataLen=0x18e0d0) returned 0 [0038.923] GetLastError () returned 0xea [0038.923] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1e64*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1e64*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.924] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2764*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2764*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.925] SetEndOfFile (hFile=0x10c) returned 1 [0038.925] CloseHandle (hObject=0x10c) returned 1 [0038.925] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.925] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.926] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7afcf70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7afcf70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.926] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8418e910, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7afcf70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7afcf70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.926] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7afcf70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7afcf70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7afcf70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.926] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.926] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84191020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84191020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.926] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.926] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84198550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84198550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lt", cAlternateFileName="")) returned 1 [0038.926] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.927] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.927] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.927] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.927] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.927] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15b0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e15b0, pdwDataLen=0x18e0d0) returned 0 [0038.927] GetLastError () returned 0xea [0038.927] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15b0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e15b0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.927] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.928] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0084*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0084*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.929] SetEndOfFile (hFile=0x10c) returned 1 [0038.929] CloseHandle (hObject=0x10c) returned 1 [0038.930] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.930] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.930] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7afcf70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7afcf70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.930] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84195e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7afcf70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7afcf70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.930] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7afcf70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7afcf70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7afcf70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.930] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.930] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84198550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8419d370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.930] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.930] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a2190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a2190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lv", cAlternateFileName="")) returned 1 [0038.930] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.931] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.931] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.931] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.931] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.931] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e0d0) returned 0 [0038.931] GetLastError () returned 0xea [0038.931] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.931] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.932] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1110*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1110*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.933] SetEndOfFile (hFile=0x10c) returned 1 [0038.934] CloseHandle (hObject=0x10c) returned 1 [0038.934] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.934] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.934] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7b230d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7b230d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.934] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8419fa80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7b230d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7b230d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.934] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7b230d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7b230d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7b230d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.934] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.934] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a2190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a48a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.934] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.934] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841a96c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ms", cAlternateFileName="")) returned 1 [0038.934] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.935] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.935] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.935] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.935] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.935] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e0d0) returned 0 [0038.935] GetLastError () returned 0xea [0038.935] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.935] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.936] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1f7c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1f7c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.937] SetEndOfFile (hFile=0x10c) returned 1 [0038.937] CloseHandle (hObject=0x10c) returned 1 [0038.938] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.938] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.938] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7b230d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7b230d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.938] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841a6fb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7b230d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7b230d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.938] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7b230d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7b230d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7b230d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.938] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.938] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841a96c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841a96c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.938] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.938] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b0bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="nl", cAlternateFileName="")) returned 1 [0038.938] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.939] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.939] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.939] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0038.939] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0038.939] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f00bc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f00bc, pdwDataLen=0x18e0d0) returned 0 [0038.939] GetLastError () returned 0xea [0038.939] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f00bc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f00bc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.939] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.940] WriteFile (in: hFile=0x10c, lpBuffer=0x33e14e4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e14e4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.941] SetEndOfFile (hFile=0x10c) returned 1 [0038.941] CloseHandle (hObject=0x10c) returned 1 [0038.941] CryptDestroyKey (hKey=0x5c9180) returned 1 [0038.941] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.942] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7b230d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7b230d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0038.942] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ae4e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7b230d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7b230d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.942] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7b230d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7b230d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7b230d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.942] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.942] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b0bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b0bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.942] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0038.942] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841b8120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="no", cAlternateFileName="")) returned 1 [0038.942] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0038.943] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0038.943] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0038.943] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0038.943] CryptDestroyHash (hHash=0x5c9180) returned 1 [0038.943] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f009c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f009c, pdwDataLen=0x18e0d0) returned 0 [0038.943] GetLastError () returned 0xea [0038.943] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f009c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f009c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0038.943] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0038.944] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d2c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d2c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0038.945] SetEndOfFile (hFile=0x10c) returned 1 [0038.945] CloseHandle (hObject=0x10c) returned 1 [0038.945] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0038.946] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0038.946] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7b230d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7b230d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0038.946] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841b5a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7b230d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7b230d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0038.946] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7b230d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7b230d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7b230d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0038.946] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0038.946] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841b8120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841b8120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0038.946] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0038.946] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841bf650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pl", cAlternateFileName="")) returned 1 [0038.946] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.113] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.113] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.113] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.113] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.113] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f008c, pdwDataLen=0x18e0d0) returned 0 [0039.113] GetLastError () returned 0xea [0039.113] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.114] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.115] WriteFile (in: hFile=0x10c, lpBuffer=0x33e18d8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e18d8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.115] SetEndOfFile (hFile=0x10c) returned 1 [0039.116] CloseHandle (hObject=0x10c) returned 1 [0039.116] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.116] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.116] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7cc5ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7cc5ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.116] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841bcf40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7cc5ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7cc5ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.116] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7cc5ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7cc5ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7cc5ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.116] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.116] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841bf650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841bf650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.116] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.116] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841c9290, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0039.116] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.117] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.117] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.117] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.117] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.117] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f008c, pdwDataLen=0x18e0d0) returned 0 [0039.117] GetLastError () returned 0xea [0039.117] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.168] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1da4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1da4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.169] SetEndOfFile (hFile=0x10c) returned 1 [0039.169] CloseHandle (hObject=0x10c) returned 1 [0039.169] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.169] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.169] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7cc5ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7cc5ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.170] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841c6b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7cc5ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7cc5ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.170] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7cc5ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7cc5ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d5e570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.170] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.170] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841c9290, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841c9290, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.170] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.170] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d07c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0039.170] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.171] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.171] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.171] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.171] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.171] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f008c, pdwDataLen=0x18e0d0) returned 0 [0039.171] GetLastError () returned 0xea [0039.171] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f008c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.171] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.172] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1dcc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1dcc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.174] SetEndOfFile (hFile=0x10c) returned 1 [0039.175] CloseHandle (hObject=0x10c) returned 1 [0039.175] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.175] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d5e570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d5e570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.175] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841ce0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d5e570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d5e570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.175] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7d5e570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7d5e570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d5e570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.175] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.175] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d07c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d07c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.175] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.175] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841d7cf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ro", cAlternateFileName="")) returned 1 [0039.175] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.176] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.176] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.176] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.176] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.176] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0718*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0718, pdwDataLen=0x18e0d0) returned 0 [0039.176] GetLastError () returned 0xea [0039.176] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0718*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0718*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.176] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.177] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03e0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03e0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.178] SetEndOfFile (hFile=0x10c) returned 1 [0039.178] CloseHandle (hObject=0x10c) returned 1 [0039.178] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.178] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.178] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d5e570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d5e570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.178] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841d55e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d5e570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d5e570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.178] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7d5e570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7d5e570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d5e570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.178] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.178] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841d7cf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841d7cf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.178] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.178] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841df220, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ru", cAlternateFileName="")) returned 1 [0039.178] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.179] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.179] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.179] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.179] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.179] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17bc, pdwDataLen=0x18e0d0) returned 0 [0039.179] GetLastError () returned 0xea [0039.179] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.180] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.180] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2cf0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2cf0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.181] SetEndOfFile (hFile=0x10c) returned 1 [0039.181] CloseHandle (hObject=0x10c) returned 1 [0039.181] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.181] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d5e570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d5e570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.182] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841dcb10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d5e570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d5e570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.182] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7d5e570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7d5e570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.182] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.182] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841df220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841df220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.182] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.182] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f0390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sk", cAlternateFileName="")) returned 1 [0039.182] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.182] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.182] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.182] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.183] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.183] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0708, pdwDataLen=0x18e0d0) returned 0 [0039.183] GetLastError () returned 0xea [0039.183] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.183] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.183] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03f0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03f0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.184] SetEndOfFile (hFile=0x10c) returned 1 [0039.184] CloseHandle (hObject=0x10c) returned 1 [0039.184] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.184] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.184] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.185] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841eb570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.185] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7d846d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.185] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.185] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f0390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f0390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.185] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.185] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841f78c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sl", cAlternateFileName="")) returned 1 [0039.185] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.185] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.185] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.186] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.186] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.186] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f28d4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f28d4, pdwDataLen=0x18e0d0) returned 0 [0039.186] GetLastError () returned 0xea [0039.186] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f28d4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f28d4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.186] WriteFile (in: hFile=0x10c, lpBuffer=0x33e11fc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e11fc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.187] SetEndOfFile (hFile=0x10c) returned 1 [0039.187] CloseHandle (hObject=0x10c) returned 1 [0039.187] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.187] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.187] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.188] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841f51b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.188] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7d846d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.188] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.188] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841f78c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841f78c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.188] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.188] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x841fedf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sr", cAlternateFileName="")) returned 1 [0039.188] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.188] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.189] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.189] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.189] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.189] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17dc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17dc, pdwDataLen=0x18e0d0) returned 0 [0039.189] GetLastError () returned 0xea [0039.189] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17dc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17dc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.189] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.189] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1cf8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1cf8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.190] SetEndOfFile (hFile=0x10c) returned 1 [0039.190] CloseHandle (hObject=0x10c) returned 1 [0039.190] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.190] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.191] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.191] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x841fc6e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.191] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7d846d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.191] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.191] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x841fedf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x841fedf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b6ac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.191] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.191] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84206320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sv", cAlternateFileName="")) returned 1 [0039.191] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.192] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.192] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.192] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.192] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.192] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1550*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1550, pdwDataLen=0x18e0d0) returned 0 [0039.192] GetLastError () returned 0xea [0039.192] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1550*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1550*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.192] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.192] WriteFile (in: hFile=0x10c, lpBuffer=0x33e17b8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e17b8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.193] SetEndOfFile (hFile=0x10c) returned 1 [0039.193] CloseHandle (hObject=0x10c) returned 1 [0039.194] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.194] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.194] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.194] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84203c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.194] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7d846d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.194] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.194] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84206320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84206320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.194] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.194] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8420d850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="th", cAlternateFileName="")) returned 1 [0039.194] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.195] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.195] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.195] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.195] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.195] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e0d0) returned 0 [0039.195] GetLastError () returned 0xea [0039.195] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.195] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.195] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03e0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03e0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.196] SetEndOfFile (hFile=0x10c) returned 1 [0039.196] CloseHandle (hObject=0x10c) returned 1 [0039.197] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.197] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.197] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8420b140, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7d846d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7d846d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7d846d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7daa830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8420d850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8420d850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.197] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.197] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84212670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84212670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="tr", cAlternateFileName="")) returned 1 [0039.197] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.198] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.198] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.198] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.198] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.198] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f296c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f296c, pdwDataLen=0x18e0d0) returned 0 [0039.198] GetLastError () returned 0xea [0039.198] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f296c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f296c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.198] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.199] WriteFile (in: hFile=0x10c, lpBuffer=0x33e199c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e199c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.199] SetEndOfFile (hFile=0x10c) returned 1 [0039.200] CloseHandle (hObject=0x10c) returned 1 [0039.200] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.200] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7daa830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7daa830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.200] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7daa830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7daa830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.200] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7daa830, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7daa830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7daa830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.200] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.200] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84212670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84214d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.200] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.200] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8421c2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="uk", cAlternateFileName="")) returned 1 [0039.200] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.201] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.201] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.201] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.201] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.201] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f295c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f295c, pdwDataLen=0x18e0d0) returned 0 [0039.201] GetLastError () returned 0xea [0039.201] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f295c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f295c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.201] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.202] WriteFile (in: hFile=0x10c, lpBuffer=0x33e11ec*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e11ec*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.203] SetEndOfFile (hFile=0x10c) returned 1 [0039.203] CloseHandle (hObject=0x10c) returned 1 [0039.203] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.203] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.203] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7daa830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7daa830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.203] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84219ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7daa830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7daa830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.203] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7daa830, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7daa830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7daa830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.203] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.203] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8421c2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8421c2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.203] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.203] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x842237e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="vi", cAlternateFileName="")) returned 1 [0039.203] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.204] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.204] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.204] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.204] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.204] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17cc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17cc, pdwDataLen=0x18e0d0) returned 0 [0039.204] GetLastError () returned 0xea [0039.204] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17cc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17cc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.204] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.207] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2ce0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2ce0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.208] SetEndOfFile (hFile=0x10c) returned 1 [0039.208] CloseHandle (hObject=0x10c) returned 1 [0039.208] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.208] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.208] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7daa830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7daa830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.209] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842210d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7daa830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7daa830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.209] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7daa830, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7daa830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7daa830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.209] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.209] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x842237e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x842237e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.209] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.209] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8422ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0039.209] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.209] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.209] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.209] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.209] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.209] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0720, pdwDataLen=0x18e0d0) returned 0 [0039.209] GetLastError () returned 0xea [0039.210] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0720*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.210] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.210] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2a80*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2a80*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.211] SetEndOfFile (hFile=0x10c) returned 1 [0039.495] CloseHandle (hObject=0x10c) returned 1 [0039.495] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.495] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.495] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7daa830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7daa830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.496] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84228600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa7daa830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7daa830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.496] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7daa830, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7daa830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa807e250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.496] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.496] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8422ad10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8422ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.496] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.496] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0039.496] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.497] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.497] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.497] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.497] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.497] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0d30*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0d30, pdwDataLen=0x18e0d0) returned 0 [0039.497] GetLastError () returned 0xea [0039.497] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0d30*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0d30*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.497] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.498] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2dec*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2dec*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.499] SetEndOfFile (hFile=0x10c) returned 1 [0039.499] CloseHandle (hObject=0x10c) returned 1 [0039.499] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.499] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.499] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa807e250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa807e250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.499] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa807e250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa807e250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.499] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa807e250, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa807e250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa807e250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.499] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.499] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84232240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844b91d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.499] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.499] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8422fb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84232240, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84232240, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0039.499] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.499] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0039.499] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0039.500] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0039.500] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.500] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c9180) returned 1 [0039.500] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.500] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e338) returned 0 [0039.500] GetLastError () returned 0xea [0039.500] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e334*=0x260) returned 1 [0039.501] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.506] WriteFile (in: hFile=0x100, lpBuffer=0x33e1fa8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33e1fa8*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0039.507] SetEndOfFile (hFile=0x100) returned 1 [0039.507] CloseHandle (hObject=0x100) returned 1 [0039.508] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.508] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.508] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa807e250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa807e250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.508] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa807e250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa807e250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.508] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x844eed30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0039.508] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa807e250, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa807e250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa807e250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.508] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0039.508] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8424a8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8424a8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbcc13a00, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2b56, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0039.508] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.508] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x842481d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x844eed30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x844eed30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0039.508] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0039.508] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a3e890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x79726e6f, dwReserved1=0x52747470, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.508] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a3e890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7a3e890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7a3e890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x79726e6f, dwReserved1=0x52747470, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0039.508] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.508] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86322450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86322450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1 [0039.508] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0039.509] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0039.509] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.509] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9200) returned 1 [0039.509] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.509] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1800*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e1800, pdwDataLen=0x18e808) returned 0 [0039.509] GetLastError () returned 0xea [0039.509] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1800*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e1800*, pdwDataLen=0x18e804*=0x260) returned 1 [0039.509] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0039.510] WriteFile (in: hFile=0x104, lpBuffer=0x33f03e4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33f03e4*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0039.511] SetEndOfFile (hFile=0x104) returned 1 [0039.511] CloseHandle (hObject=0x104) returned 1 [0039.511] CryptDestroyKey (hKey=0x5c9200) returned 1 [0039.511] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.511] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0039.511] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x862fc2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.511] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa2466f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2466f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1.4_0", cAlternateFileName="")) returned 1 [0039.511] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0039.512] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0039.512] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.512] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9180) returned 1 [0039.512] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.512] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0720, pdwDataLen=0x18e5a0) returned 0 [0039.512] GetLastError () returned 0xea [0039.512] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e0720*, pdwDataLen=0x18e59c*=0x260) returned 1 [0039.512] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.513] WriteFile (in: hFile=0xfc, lpBuffer=0x33f1f54*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33f1f54*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0039.514] SetEndOfFile (hFile=0xfc) returned 1 [0039.514] CloseHandle (hObject=0xfc) returned 1 [0039.514] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.514] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.514] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.514] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.514] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2466f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2466f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2466f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="128.png.crypt", cAlternateFileName="128PNG~1.CRY")) returned 1 [0039.514] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="contentscript_bin_prod.js", cAlternateFileName="CONTEN~1.JS")) returned 1 [0039.514] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="dasherSettingSchema.json", cAlternateFileName="DASHER~1.JSO")) returned 1 [0039.514] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x5b6c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="eventpage_bin_prod.js", cAlternateFileName="EVENTP~1.JS")) returned 1 [0039.514] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80a43b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.514] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0039.514] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="page_embed_script.js", cAlternateFileName="PAGE_E~1.JS")) returned 1 [0039.514] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_locales", cAlternateFileName="")) returned 1 [0039.514] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0039.515] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0039.515] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.515] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c91c0) returned 1 [0039.515] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.515] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f00b4*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f00b4, pdwDataLen=0x18e338) returned 0 [0039.515] GetLastError () returned 0xea [0039.515] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f00b4*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f00b4*, pdwDataLen=0x18e334*=0x260) returned 1 [0039.515] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.516] WriteFile (in: hFile=0x100, lpBuffer=0x33f1f54*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33f1f54*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0039.517] SetEndOfFile (hFile=0x100) returned 1 [0039.517] CloseHandle (hObject=0x100) returned 1 [0039.517] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.517] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.517] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.517] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.518] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="af", cAlternateFileName="")) returned 1 [0039.518] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.518] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.518] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.518] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.518] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.518] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f009c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f009c, pdwDataLen=0x18e0d0) returned 0 [0039.518] GetLastError () returned 0xea [0039.518] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f009c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f009c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.519] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.519] WriteFile (in: hFile=0x10c, lpBuffer=0x33f17a4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f17a4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.520] SetEndOfFile (hFile=0x10c) returned 1 [0039.520] CloseHandle (hObject=0x10c) returned 1 [0039.520] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.520] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.520] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.520] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.520] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80a43b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.520] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.520] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.520] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.521] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="am", cAlternateFileName="")) returned 1 [0039.521] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.521] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.521] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.521] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.521] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.521] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0e04*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0e04, pdwDataLen=0x18e0d0) returned 0 [0039.521] GetLastError () returned 0xea [0039.521] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0e04*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0e04*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.522] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.522] WriteFile (in: hFile=0x10c, lpBuffer=0x33f22c0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f22c0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.523] SetEndOfFile (hFile=0x10c) returned 1 [0039.523] CloseHandle (hObject=0x10c) returned 1 [0039.523] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.523] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.523] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.524] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.524] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80a43b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.524] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.524] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.524] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.524] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ar", cAlternateFileName="")) returned 1 [0039.524] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.524] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.524] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.524] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.525] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.525] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f00bc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f00bc, pdwDataLen=0x18e0d0) returned 0 [0039.525] GetLastError () returned 0xea [0039.525] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f00bc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f00bc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.525] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.525] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2a50*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2a50*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.526] SetEndOfFile (hFile=0x10c) returned 1 [0039.526] CloseHandle (hObject=0x10c) returned 1 [0039.526] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.526] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.527] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.527] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.527] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80ca510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.527] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.527] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.527] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.527] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="az", cAlternateFileName="")) returned 1 [0039.527] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.528] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.528] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.528] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.528] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.528] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1400*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1400, pdwDataLen=0x18e0d0) returned 0 [0039.528] GetLastError () returned 0xea [0039.528] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1400*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1400*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.528] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.528] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2dbc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2dbc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.529] SetEndOfFile (hFile=0x10c) returned 1 [0039.529] CloseHandle (hObject=0x10c) returned 1 [0039.529] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.530] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.530] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.530] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.530] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80ca510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.530] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.530] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.530] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.530] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="bg", cAlternateFileName="")) returned 1 [0039.530] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.531] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.531] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.531] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.531] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.531] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e070c, pdwDataLen=0x18e0d0) returned 0 [0039.531] GetLastError () returned 0xea [0039.531] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.531] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.531] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03f0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03f0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.532] SetEndOfFile (hFile=0x10c) returned 1 [0039.532] CloseHandle (hObject=0x10c) returned 1 [0039.533] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.533] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.533] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.533] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.533] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80ca510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.533] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.533] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.533] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.533] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="bn", cAlternateFileName="")) returned 1 [0039.533] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.534] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.534] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.534] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.534] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.534] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2654*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2654, pdwDataLen=0x18e0d0) returned 0 [0039.534] GetLastError () returned 0xea [0039.534] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2654*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2654*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.534] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.534] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.535] SetEndOfFile (hFile=0x10c) returned 1 [0039.535] CloseHandle (hObject=0x10c) returned 1 [0039.535] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.535] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.536] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80ca510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.536] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.536] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.536] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ca", cAlternateFileName="")) returned 1 [0039.536] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.537] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.537] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.537] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.537] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.537] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2644*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2644, pdwDataLen=0x18e0d0) returned 0 [0039.537] GetLastError () returned 0xea [0039.537] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2644*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2644*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.538] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d1c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d1c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.539] SetEndOfFile (hFile=0x10c) returned 1 [0039.539] CloseHandle (hObject=0x10c) returned 1 [0039.539] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.539] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.539] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.539] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80ca510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.539] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80ca510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80ca510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.539] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.539] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.540] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.540] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="cs", cAlternateFileName="")) returned 1 [0039.540] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.540] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.540] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.540] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.540] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.540] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.540] GetLastError () returned 0xea [0039.540] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.541] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.541] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03f0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03f0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.542] SetEndOfFile (hFile=0x10c) returned 1 [0039.542] CloseHandle (hObject=0x10c) returned 1 [0039.542] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.542] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.542] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80f0670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.542] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.542] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.543] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="da", cAlternateFileName="")) returned 1 [0039.543] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.543] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.543] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.543] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.543] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.543] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15b4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e15b4, pdwDataLen=0x18e0d0) returned 0 [0039.543] GetLastError () returned 0xea [0039.543] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15b4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e15b4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.544] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.544] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1fcc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1fcc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.545] SetEndOfFile (hFile=0x10c) returned 1 [0039.545] CloseHandle (hObject=0x10c) returned 1 [0039.545] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.545] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.545] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.545] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.545] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80f0670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.545] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.545] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.545] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.546] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="de", cAlternateFileName="")) returned 1 [0039.546] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.546] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.546] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.546] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.546] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.546] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15a4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e15a4, pdwDataLen=0x18e0d0) returned 0 [0039.546] GetLastError () returned 0xea [0039.546] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15a4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e15a4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.547] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.547] WriteFile (in: hFile=0x10c, lpBuffer=0x33e180c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e180c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.548] SetEndOfFile (hFile=0x10c) returned 1 [0039.548] CloseHandle (hObject=0x10c) returned 1 [0039.548] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.548] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.548] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80f0670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.548] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.548] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.548] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="el", cAlternateFileName="")) returned 1 [0039.549] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.549] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.549] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.549] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.549] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.549] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e070c, pdwDataLen=0x18e0d0) returned 0 [0039.549] GetLastError () returned 0xea [0039.549] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.550] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.550] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03f0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03f0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.551] SetEndOfFile (hFile=0x10c) returned 1 [0039.551] CloseHandle (hObject=0x10c) returned 1 [0039.551] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.551] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.551] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.551] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.551] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80f0670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.551] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.551] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.551] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.551] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e23760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e23760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en_GB", cAlternateFileName="")) returned 1 [0039.551] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.552] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.552] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.552] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.552] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.552] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2954*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2954, pdwDataLen=0x18e0d0) returned 0 [0039.552] GetLastError () returned 0xea [0039.552] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2954*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2954*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.553] WriteFile (in: hFile=0x10c, lpBuffer=0x33e19d0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e19d0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.554] SetEndOfFile (hFile=0x10c) returned 1 [0039.554] CloseHandle (hObject=0x10c) returned 1 [0039.554] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.554] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.554] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.554] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80f0670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80f0670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80f0670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.554] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.554] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e256a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.554] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.555] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en_US", cAlternateFileName="")) returned 1 [0039.555] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.555] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.555] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.555] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.555] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.555] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17e8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17e8, pdwDataLen=0x18e0d0) returned 0 [0039.555] GetLastError () returned 0xea [0039.555] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17e8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17e8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.556] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.556] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d1c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d1c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.557] SetEndOfFile (hFile=0x10c) returned 1 [0039.557] CloseHandle (hObject=0x10c) returned 1 [0039.557] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.557] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.557] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.558] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e23760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.558] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81167d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.558] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.558] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.558] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.558] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es", cAlternateFileName="")) returned 1 [0039.558] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.558] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.559] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.559] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.559] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.559] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1594*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1594, pdwDataLen=0x18e0d0) returned 0 [0039.559] GetLastError () returned 0xea [0039.559] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1594*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1594*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.559] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.559] WriteFile (in: hFile=0x10c, lpBuffer=0x33e17fc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e17fc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.560] SetEndOfFile (hFile=0x10c) returned 1 [0039.560] CloseHandle (hObject=0x10c) returned 1 [0039.560] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.560] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.560] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.561] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.561] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81167d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.561] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.561] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.561] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.561] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es_419", cAlternateFileName="")) returned 1 [0039.561] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.562] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.562] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.562] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.562] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.562] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e070c, pdwDataLen=0x18e0d0) returned 0 [0039.562] GetLastError () returned 0xea [0039.562] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.562] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.562] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1344*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1344*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.563] SetEndOfFile (hFile=0x10c) returned 1 [0039.563] CloseHandle (hObject=0x10c) returned 1 [0039.563] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.563] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.563] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.564] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.564] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81167d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.564] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.564] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.564] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.564] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="et", cAlternateFileName="")) returned 1 [0039.564] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.565] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.565] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.565] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.565] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.565] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22c8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f22c8, pdwDataLen=0x18e0d0) returned 0 [0039.565] GetLastError () returned 0xea [0039.565] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22c8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f22c8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.565] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.565] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0d14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0d14*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.566] SetEndOfFile (hFile=0x10c) returned 1 [0039.566] CloseHandle (hObject=0x10c) returned 1 [0039.566] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.567] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.567] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.567] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.567] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81167d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.567] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.567] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.567] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.567] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="eu", cAlternateFileName="")) returned 1 [0039.567] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.568] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.568] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.568] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.568] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.568] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e072c, pdwDataLen=0x18e0d0) returned 0 [0039.568] GetLastError () returned 0xea [0039.568] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e072c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.568] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.568] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0d10*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0d10*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.569] SetEndOfFile (hFile=0x10c) returned 1 [0039.569] CloseHandle (hObject=0x10c) returned 1 [0039.570] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.570] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.570] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.570] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.570] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81167d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81167d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81167d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.570] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.570] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.570] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.571] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fa", cAlternateFileName="")) returned 1 [0039.571] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.571] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.571] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.571] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.571] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.571] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17bc, pdwDataLen=0x18e0d0) returned 0 [0039.571] GetLastError () returned 0xea [0039.572] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.572] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.572] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2cf0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2cf0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.573] SetEndOfFile (hFile=0x10c) returned 1 [0039.573] CloseHandle (hObject=0x10c) returned 1 [0039.573] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.573] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.573] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.574] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.574] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa813c930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.574] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.574] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.574] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.574] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fi", cAlternateFileName="")) returned 1 [0039.574] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.574] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.574] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.574] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.574] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.574] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e071c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e071c, pdwDataLen=0x18e0d0) returned 0 [0039.574] GetLastError () returned 0xea [0039.575] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e071c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e071c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.575] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.575] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0d10*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0d10*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.576] SetEndOfFile (hFile=0x10c) returned 1 [0039.577] CloseHandle (hObject=0x10c) returned 1 [0039.577] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.577] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.577] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.577] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.577] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa813c930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.577] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.577] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.577] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.577] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fil", cAlternateFileName="")) returned 1 [0039.577] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.578] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.578] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.578] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.578] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.578] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f28d4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f28d4, pdwDataLen=0x18e0d0) returned 0 [0039.578] GetLastError () returned 0xea [0039.578] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f28d4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f28d4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.578] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.579] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1220*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1220*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.579] SetEndOfFile (hFile=0x10c) returned 1 [0039.580] CloseHandle (hObject=0x10c) returned 1 [0039.580] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.580] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.580] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.580] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.580] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa813c930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.580] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.580] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.580] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.580] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fr", cAlternateFileName="")) returned 1 [0039.580] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.581] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.581] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.581] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.581] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.581] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17cc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17cc, pdwDataLen=0x18e0d0) returned 0 [0039.581] GetLastError () returned 0xea [0039.581] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17cc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17cc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.581] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.582] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d1c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d1c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.583] SetEndOfFile (hFile=0x10c) returned 1 [0039.583] CloseHandle (hObject=0x10c) returned 1 [0039.583] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.583] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.583] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.583] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.583] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa813c930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.583] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.583] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.583] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.583] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fr_CA", cAlternateFileName="")) returned 1 [0039.583] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.584] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.584] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.584] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.584] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.584] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e159c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e159c, pdwDataLen=0x18e0d0) returned 0 [0039.584] GetLastError () returned 0xea [0039.584] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e159c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e159c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.584] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.585] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1804*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1804*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.585] SetEndOfFile (hFile=0x10c) returned 1 [0039.586] CloseHandle (hObject=0x10c) returned 1 [0039.586] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.586] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.586] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.586] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.586] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa813c930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa813c930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa813c930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.586] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.586] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.586] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.586] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="gl", cAlternateFileName="")) returned 1 [0039.586] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.587] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.587] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.587] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.587] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.587] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e070c, pdwDataLen=0x18e0d0) returned 0 [0039.587] GetLastError () returned 0xea [0039.587] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.587] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.588] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03f0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03f0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.589] SetEndOfFile (hFile=0x10c) returned 1 [0039.589] CloseHandle (hObject=0x10c) returned 1 [0039.589] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.589] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.589] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.589] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.589] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8162a90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.589] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.589] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xac, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.589] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.590] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="gu", cAlternateFileName="")) returned 1 [0039.590] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.590] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.590] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.590] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.590] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.590] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2960*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2960, pdwDataLen=0x18e0d0) returned 0 [0039.590] GetLastError () returned 0xea [0039.590] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2960*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2960*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.591] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.591] WriteFile (in: hFile=0x10c, lpBuffer=0x33e19b0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e19b0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.592] SetEndOfFile (hFile=0x10c) returned 1 [0039.592] CloseHandle (hObject=0x10c) returned 1 [0039.592] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.592] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.592] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.592] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.592] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8162a90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.592] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.592] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.593] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.593] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hi", cAlternateFileName="")) returned 1 [0039.593] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.593] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.593] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.593] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.593] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.593] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2950*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2950, pdwDataLen=0x18e0d0) returned 0 [0039.593] GetLastError () returned 0xea [0039.593] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2950*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2950*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.594] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.594] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d1c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d1c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.595] SetEndOfFile (hFile=0x10c) returned 1 [0039.595] CloseHandle (hObject=0x10c) returned 1 [0039.595] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.595] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.595] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.595] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.595] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8162a90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.595] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.596] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.596] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80a43b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hr", cAlternateFileName="")) returned 1 [0039.596] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.596] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.596] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.596] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.596] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.596] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b28*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1b28, pdwDataLen=0x18e0d0) returned 0 [0039.596] GetLastError () returned 0xea [0039.596] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b28*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1b28*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.597] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.597] WriteFile (in: hFile=0x10c, lpBuffer=0x33e158c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e158c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.598] SetEndOfFile (hFile=0x10c) returned 1 [0039.598] CloseHandle (hObject=0x10c) returned 1 [0039.598] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.598] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.598] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.598] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.599] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8162a90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.599] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.599] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.599] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.599] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e95b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hu", cAlternateFileName="")) returned 1 [0039.599] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.599] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.599] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.599] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.599] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.599] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e072c, pdwDataLen=0x18e0d0) returned 0 [0039.599] GetLastError () returned 0xea [0039.599] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e072c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.600] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.600] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2a60*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2a60*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.601] SetEndOfFile (hFile=0x10c) returned 1 [0039.601] CloseHandle (hObject=0x10c) returned 1 [0039.601] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.601] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.601] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.601] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.602] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8162a90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8162a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8162a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.602] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.602] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e95b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e95b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.602] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.602] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hy", cAlternateFileName="")) returned 1 [0039.602] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.602] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.602] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.602] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.602] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.602] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1808*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1808, pdwDataLen=0x18e0d0) returned 0 [0039.602] GetLastError () returned 0xea [0039.602] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1808*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1808*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.603] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.603] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2dcc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2dcc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.604] SetEndOfFile (hFile=0x10c) returned 1 [0039.604] CloseHandle (hObject=0x10c) returned 1 [0039.604] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.604] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.604] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.605] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.605] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8188bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.605] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.605] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x299, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.605] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.605] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="id", cAlternateFileName="")) returned 1 [0039.605] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.605] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.605] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.605] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.605] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.605] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e072c, pdwDataLen=0x18e0d0) returned 0 [0039.605] GetLastError () returned 0xea [0039.606] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e072c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.606] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.606] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03f0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03f0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.607] SetEndOfFile (hFile=0x10c) returned 1 [0039.607] CloseHandle (hObject=0x10c) returned 1 [0039.607] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.607] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.607] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.608] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.608] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8188bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.608] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.608] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.608] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.608] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="is", cAlternateFileName="")) returned 1 [0039.608] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.608] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.608] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.608] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.608] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.608] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17bc, pdwDataLen=0x18e0d0) returned 0 [0039.608] GetLastError () returned 0xea [0039.609] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.609] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.609] WriteFile (in: hFile=0x10c, lpBuffer=0x33e19e0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e19e0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.610] SetEndOfFile (hFile=0x10c) returned 1 [0039.610] CloseHandle (hObject=0x10c) returned 1 [0039.610] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.610] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.610] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.611] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.611] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8188bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.611] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.611] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.611] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.611] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="it", cAlternateFileName="")) returned 1 [0039.611] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.611] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.611] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.611] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.611] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.611] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a4c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1a4c, pdwDataLen=0x18e0d0) returned 0 [0039.612] GetLastError () returned 0xea [0039.612] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a4c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1a4c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.612] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.612] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d4c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d4c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.613] SetEndOfFile (hFile=0x10c) returned 1 [0039.613] CloseHandle (hObject=0x10c) returned 1 [0039.613] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.613] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.613] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.614] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.614] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8188bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.614] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.614] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.614] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.614] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebbce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ebbce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="iw", cAlternateFileName="")) returned 1 [0039.614] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.614] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.614] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.615] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.615] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.615] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15d4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e15d4, pdwDataLen=0x18e0d0) returned 0 [0039.615] GetLastError () returned 0xea [0039.615] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15d4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e15d4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.615] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.618] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03f0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03f0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.619] SetEndOfFile (hFile=0x10c) returned 1 [0039.619] CloseHandle (hObject=0x10c) returned 1 [0039.619] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.619] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.620] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.620] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8188bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.620] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8188bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8188bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81aed50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.620] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.620] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ebbce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ebcc80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.620] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.620] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ja", cAlternateFileName="")) returned 1 [0039.620] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.620] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.621] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.621] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.621] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.621] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15c4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e15c4, pdwDataLen=0x18e0d0) returned 0 [0039.621] GetLastError () returned 0xea [0039.621] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15c4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e15c4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.621] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.621] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1fdc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1fdc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.622] SetEndOfFile (hFile=0x10c) returned 1 [0039.622] CloseHandle (hObject=0x10c) returned 1 [0039.622] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.622] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.623] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81aed50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81aed50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.623] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81aed50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81aed50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.623] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81aed50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81aed50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81aed50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.623] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.623] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.623] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.623] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ka", cAlternateFileName="")) returned 1 [0039.623] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.623] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.624] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.624] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.624] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.624] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e070c, pdwDataLen=0x18e0d0) returned 0 [0039.624] GetLastError () returned 0xea [0039.624] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.624] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.624] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1c40*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1c40*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.625] SetEndOfFile (hFile=0x10c) returned 1 [0039.626] CloseHandle (hObject=0x10c) returned 1 [0039.626] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.626] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.626] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81aed50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81aed50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.626] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81aed50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81aed50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.626] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81aed50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81aed50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81aed50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.626] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.626] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x165, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.626] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.626] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="km", cAlternateFileName="")) returned 1 [0039.626] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.627] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.627] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.627] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.627] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.627] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f00bc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f00bc, pdwDataLen=0x18e0d0) returned 0 [0039.627] GetLastError () returned 0xea [0039.627] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f00bc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f00bc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.627] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.628] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1f8c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1f8c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.628] SetEndOfFile (hFile=0x10c) returned 1 [0039.629] CloseHandle (hObject=0x10c) returned 1 [0039.629] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.629] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.629] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81aed50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81aed50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.629] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81aed50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81aed50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.629] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81aed50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81aed50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81aed50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.629] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.629] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.629] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.629] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="kn", cAlternateFileName="")) returned 1 [0039.629] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.630] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.630] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.630] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.630] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.630] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e17f4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e17f4, pdwDataLen=0x18e0d0) returned 0 [0039.630] GetLastError () returned 0xea [0039.630] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e17f4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e17f4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.630] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.631] WriteFile (in: hFile=0x10c, lpBuffer=0x33f22d0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f22d0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.632] SetEndOfFile (hFile=0x10c) returned 1 [0039.632] CloseHandle (hObject=0x10c) returned 1 [0039.632] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.632] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.632] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81aed50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81aed50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.632] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81aed50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81aed50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.632] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81aed50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81aed50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81aed50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.632] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.632] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x147, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.632] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.632] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee1e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ee1e40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ko", cAlternateFileName="")) returned 1 [0039.632] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.633] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.633] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.633] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.633] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.633] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e074c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e074c, pdwDataLen=0x18e0d0) returned 0 [0039.633] GetLastError () returned 0xea [0039.633] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e074c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e074c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.633] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.634] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2a50*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2a50*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.635] SetEndOfFile (hFile=0x10c) returned 1 [0039.635] CloseHandle (hObject=0x10c) returned 1 [0039.635] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.635] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.635] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.635] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.635] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81d4eb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.635] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.635] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ee1e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ee3d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.635] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.635] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lo", cAlternateFileName="")) returned 1 [0039.635] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.636] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.636] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.636] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.636] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.636] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22a8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f22a8, pdwDataLen=0x18e0d0) returned 0 [0039.636] GetLastError () returned 0xea [0039.636] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22a8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f22a8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.637] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.637] WriteFile (in: hFile=0x10c, lpBuffer=0x33e15bc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e15bc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.638] SetEndOfFile (hFile=0x10c) returned 1 [0039.638] CloseHandle (hObject=0x10c) returned 1 [0039.638] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.638] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.638] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.638] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81d4eb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.638] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.638] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.639] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.639] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lt", cAlternateFileName="")) returned 1 [0039.639] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.639] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.639] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.639] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.639] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.639] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.639] GetLastError () returned 0xea [0039.639] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.640] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.640] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2510*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2510*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.641] SetEndOfFile (hFile=0x10c) returned 1 [0039.641] CloseHandle (hObject=0x10c) returned 1 [0039.641] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.641] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.641] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.641] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.641] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81d4eb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.642] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.642] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.642] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.642] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lv", cAlternateFileName="")) returned 1 [0039.642] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.642] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.642] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.642] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.642] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.642] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d88*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d88, pdwDataLen=0x18e0d0) returned 0 [0039.642] GetLastError () returned 0xea [0039.642] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d88*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d88*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.643] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.643] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1ff0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1ff0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.644] SetEndOfFile (hFile=0x10c) returned 1 [0039.644] CloseHandle (hObject=0x10c) returned 1 [0039.644] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.644] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.644] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.644] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.644] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81d4eb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.645] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.645] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.645] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.645] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ml", cAlternateFileName="")) returned 1 [0039.645] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.645] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.645] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.645] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.645] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.645] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d78*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d78, pdwDataLen=0x18e0d0) returned 0 [0039.645] GetLastError () returned 0xea [0039.645] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d78*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d78*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.646] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.646] WriteFile (in: hFile=0x10c, lpBuffer=0x33f233c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f233c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.647] SetEndOfFile (hFile=0x10c) returned 1 [0039.647] CloseHandle (hObject=0x10c) returned 1 [0039.647] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.647] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.647] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.648] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.648] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81d4eb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81d4eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81d4eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.648] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.648] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.648] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.648] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="mn", cAlternateFileName="")) returned 1 [0039.648] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.649] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.649] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.649] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.649] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.649] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2048*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2048, pdwDataLen=0x18e0d0) returned 0 [0039.649] GetLastError () returned 0xea [0039.649] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2048*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2048*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.649] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.649] WriteFile (in: hFile=0x10c, lpBuffer=0x33f28f4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f28f4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.650] SetEndOfFile (hFile=0x10c) returned 1 [0039.650] CloseHandle (hObject=0x10c) returned 1 [0039.651] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.651] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.651] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.651] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.651] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81fb010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.651] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.651] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.651] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.651] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="mr", cAlternateFileName="")) returned 1 [0039.651] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.652] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.652] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.652] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.652] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.652] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2038*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2038, pdwDataLen=0x18e0d0) returned 0 [0039.652] GetLastError () returned 0xea [0039.652] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2038*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2038*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.652] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.652] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0094*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0094*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.653] SetEndOfFile (hFile=0x10c) returned 1 [0039.653] CloseHandle (hObject=0x10c) returned 1 [0039.654] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.654] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.654] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.654] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.654] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81fb010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.654] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.654] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.654] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.654] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ms", cAlternateFileName="")) returned 1 [0039.654] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.655] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.655] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.655] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.655] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.655] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1574*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1574, pdwDataLen=0x18e0d0) returned 0 [0039.655] GetLastError () returned 0xea [0039.655] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1574*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1574*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.655] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.655] WriteFile (in: hFile=0x10c, lpBuffer=0x33e17dc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e17dc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.656] SetEndOfFile (hFile=0x10c) returned 1 [0039.657] CloseHandle (hObject=0x10c) returned 1 [0039.657] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.657] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.657] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.657] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.657] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81fb010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.657] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.657] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.657] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2e100, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f2e100, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ne", cAlternateFileName="")) returned 1 [0039.657] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.658] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.658] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.658] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.658] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.658] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e070c, pdwDataLen=0x18e0d0) returned 0 [0039.658] GetLastError () returned 0xea [0039.658] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.658] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.659] WriteFile (in: hFile=0x10c, lpBuffer=0x33f262c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f262c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.660] SetEndOfFile (hFile=0x10c) returned 1 [0039.660] CloseHandle (hObject=0x10c) returned 1 [0039.660] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.660] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.660] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.660] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.660] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81fb010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.660] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.660] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f2f870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.660] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.660] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="nl", cAlternateFileName="")) returned 1 [0039.660] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.661] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.661] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.661] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.661] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.661] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2664*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2664, pdwDataLen=0x18e0d0) returned 0 [0039.661] GetLastError () returned 0xea [0039.661] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2664*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2664*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.661] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.662] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0094*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0094*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.663] SetEndOfFile (hFile=0x10c) returned 1 [0039.663] CloseHandle (hObject=0x10c) returned 1 [0039.663] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.663] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.663] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.663] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f2e100, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.663] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa81fb010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa81fb010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa81fb010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.663] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.663] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.663] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.663] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="no", cAlternateFileName="")) returned 1 [0039.663] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.665] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.665] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.665] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.665] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.665] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2654*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2654, pdwDataLen=0x18e0d0) returned 0 [0039.665] GetLastError () returned 0xea [0039.665] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2654*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2654*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.665] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.665] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2c38*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2c38*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.666] SetEndOfFile (hFile=0x10c) returned 1 [0039.666] CloseHandle (hObject=0x10c) returned 1 [0039.667] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.667] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.667] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.667] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.667] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8221170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.667] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.667] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.667] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.667] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pl", cAlternateFileName="")) returned 1 [0039.667] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.668] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.668] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.668] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.668] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.668] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.668] GetLastError () returned 0xea [0039.668] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.668] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.669] WriteFile (in: hFile=0x10c, lpBuffer=0x33f289c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f289c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.669] SetEndOfFile (hFile=0x10c) returned 1 [0039.670] CloseHandle (hObject=0x10c) returned 1 [0039.670] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.670] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.670] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.670] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.670] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8221170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.670] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.670] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.670] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f54260, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0039.670] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.671] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.671] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.671] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.671] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.671] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0734*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0734, pdwDataLen=0x18e0d0) returned 0 [0039.671] GetLastError () returned 0xea [0039.671] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0734*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0734*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.671] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.672] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1094*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1094*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.672] SetEndOfFile (hFile=0x10c) returned 1 [0039.673] CloseHandle (hObject=0x10c) returned 1 [0039.673] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.673] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.673] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.673] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.673] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8221170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.673] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.673] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f54260, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.673] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.673] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0039.673] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.674] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.674] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.674] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.674] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.674] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c24*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2c24, pdwDataLen=0x18e0d0) returned 0 [0039.674] GetLastError () returned 0xea [0039.674] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c24*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2c24*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.674] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.675] WriteFile (in: hFile=0x10c, lpBuffer=0x33e15a0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e15a0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.675] SetEndOfFile (hFile=0x10c) returned 1 [0039.676] CloseHandle (hObject=0x10c) returned 1 [0039.676] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.676] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.676] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.676] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f54260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.676] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8221170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.676] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.676] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.676] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.676] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ro", cAlternateFileName="")) returned 1 [0039.676] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.677] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.677] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.677] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.677] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.677] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17d0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17d0, pdwDataLen=0x18e0d0) returned 0 [0039.677] GetLastError () returned 0xea [0039.677] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17d0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17d0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.677] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.678] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2534*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2534*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.678] SetEndOfFile (hFile=0x10c) returned 1 [0039.679] CloseHandle (hObject=0x10c) returned 1 [0039.679] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.679] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.679] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.679] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.679] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8221170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8221170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8221170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.679] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.679] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.679] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.679] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ru", cAlternateFileName="")) returned 1 [0039.679] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.680] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.680] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.680] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.680] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.680] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1dac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1dac, pdwDataLen=0x18e0d0) returned 0 [0039.680] GetLastError () returned 0xea [0039.680] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1dac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1dac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.680] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.681] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0094*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0094*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.682] SetEndOfFile (hFile=0x10c) returned 1 [0039.682] CloseHandle (hObject=0x10c) returned 1 [0039.682] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.682] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.682] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.682] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.682] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82472d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.682] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.682] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.682] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.682] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="si", cAlternateFileName="")) returned 1 [0039.682] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.683] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.683] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.683] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.683] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.683] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d9c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d9c, pdwDataLen=0x18e0d0) returned 0 [0039.683] GetLastError () returned 0xea [0039.683] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d9c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d9c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.683] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.684] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2360*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2360*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.685] SetEndOfFile (hFile=0x10c) returned 1 [0039.685] CloseHandle (hObject=0x10c) returned 1 [0039.685] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.685] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.685] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.685] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.685] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82472d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.685] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.685] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.685] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.685] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sk", cAlternateFileName="")) returned 1 [0039.685] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.686] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.686] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.686] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.686] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.686] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e201c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e201c, pdwDataLen=0x18e0d0) returned 0 [0039.686] GetLastError () returned 0xea [0039.686] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e201c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e201c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.686] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.687] WriteFile (in: hFile=0x10c, lpBuffer=0x33f28f4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f28f4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.688] SetEndOfFile (hFile=0x10c) returned 1 [0039.688] CloseHandle (hObject=0x10c) returned 1 [0039.688] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.688] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.688] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.688] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.688] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82472d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.688] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.688] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.688] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.688] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7a3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f7a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sl", cAlternateFileName="")) returned 1 [0039.688] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.689] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.689] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.689] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.689] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.689] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e200c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e200c, pdwDataLen=0x18e0d0) returned 0 [0039.689] GetLastError () returned 0xea [0039.689] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e200c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e200c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.689] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.690] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2c80*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2c80*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.691] SetEndOfFile (hFile=0x10c) returned 1 [0039.691] CloseHandle (hObject=0x10c) returned 1 [0039.691] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.691] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.691] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.691] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.691] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82472d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.691] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.691] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f7a3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f7b360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.691] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.691] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sr", cAlternateFileName="")) returned 1 [0039.692] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.692] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.692] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.692] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.692] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.692] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1574*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1574, pdwDataLen=0x18e0d0) returned 0 [0039.692] GetLastError () returned 0xea [0039.692] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1574*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1574*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.693] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.693] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03f0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03f0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.694] SetEndOfFile (hFile=0x10c) returned 1 [0039.694] CloseHandle (hObject=0x10c) returned 1 [0039.694] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.694] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.694] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.694] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.694] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82472d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82472d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82472d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.695] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.695] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.695] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.695] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sv", cAlternateFileName="")) returned 1 [0039.695] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.695] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.695] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.695] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.695] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.695] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e070c, pdwDataLen=0x18e0d0) returned 0 [0039.695] GetLastError () returned 0xea [0039.695] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.696] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.696] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.697] SetEndOfFile (hFile=0x10c) returned 1 [0039.697] CloseHandle (hObject=0x10c) returned 1 [0039.697] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.697] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.697] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.697] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.698] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa826d430, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.698] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.698] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.698] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.698] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sw", cAlternateFileName="")) returned 1 [0039.698] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.698] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.698] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.698] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.698] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.698] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2518*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2518, pdwDataLen=0x18e0d0) returned 0 [0039.698] GetLastError () returned 0xea [0039.698] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2518*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2518*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.699] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.699] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2264*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2264*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.700] SetEndOfFile (hFile=0x10c) returned 1 [0039.700] CloseHandle (hObject=0x10c) returned 1 [0039.700] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.700] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.700] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.700] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.701] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa826d430, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.701] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.701] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.701] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.701] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ta", cAlternateFileName="")) returned 1 [0039.701] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.701] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.701] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.701] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.701] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.701] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.701] GetLastError () returned 0xea [0039.701] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.702] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.702] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2004*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2004*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.703] SetEndOfFile (hFile=0x10c) returned 1 [0039.703] CloseHandle (hObject=0x10c) returned 1 [0039.703] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.703] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.703] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.703] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa826d430, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.704] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.704] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x150, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.704] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.704] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa0520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fa0520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="te", cAlternateFileName="")) returned 1 [0039.704] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.704] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.704] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.704] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.704] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.704] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e188c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e188c, pdwDataLen=0x18e0d0) returned 0 [0039.704] GetLastError () returned 0xea [0039.704] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e188c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e188c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.705] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.706] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2068*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2068*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.707] SetEndOfFile (hFile=0x10c) returned 1 [0039.707] CloseHandle (hObject=0x10c) returned 1 [0039.707] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.707] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.707] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.707] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa826d430, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.707] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.707] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fa0520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fa2460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.707] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.707] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="th", cAlternateFileName="")) returned 1 [0039.707] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.708] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.708] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.708] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.708] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.708] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e187c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e187c, pdwDataLen=0x18e0d0) returned 0 [0039.708] GetLastError () returned 0xea [0039.708] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e187c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e187c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.708] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.709] WriteFile (in: hFile=0x10c, lpBuffer=0x33e219c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e219c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.710] SetEndOfFile (hFile=0x10c) returned 1 [0039.710] CloseHandle (hObject=0x10c) returned 1 [0039.710] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.710] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.710] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.710] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.710] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa826d430, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa826d430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa826d430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.710] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.710] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.710] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.710] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="tr", cAlternateFileName="")) returned 1 [0039.710] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.711] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.711] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.711] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.711] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.711] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e072c, pdwDataLen=0x18e0d0) returned 0 [0039.711] GetLastError () returned 0xea [0039.711] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e072c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.712] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.712] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1f54*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1f54*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.713] SetEndOfFile (hFile=0x10c) returned 1 [0039.713] CloseHandle (hObject=0x10c) returned 1 [0039.713] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.713] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.713] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.713] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.713] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8293590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.713] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.714] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.714] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.714] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="uk", cAlternateFileName="")) returned 1 [0039.714] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.714] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.714] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.714] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.714] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.714] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e09bc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e09bc, pdwDataLen=0x18e0d0) returned 0 [0039.714] GetLastError () returned 0xea [0039.714] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e09bc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e09bc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.715] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.715] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1ef0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1ef0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.716] SetEndOfFile (hFile=0x10c) returned 1 [0039.716] CloseHandle (hObject=0x10c) returned 1 [0039.716] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.716] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.716] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.716] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.716] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8293590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.716] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.716] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.717] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.717] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ur", cAlternateFileName="")) returned 1 [0039.717] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.717] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.717] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.717] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.717] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.717] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1768*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1768, pdwDataLen=0x18e0d0) returned 0 [0039.717] GetLastError () returned 0xea [0039.717] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1768*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1768*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.718] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.718] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2dbc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2dbc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.719] SetEndOfFile (hFile=0x10c) returned 1 [0039.719] CloseHandle (hObject=0x10c) returned 1 [0039.719] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.719] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.719] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.720] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.720] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8293590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.720] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.720] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.720] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.720] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="vi", cAlternateFileName="")) returned 1 [0039.720] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.720] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.720] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.720] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.720] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.720] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e072c, pdwDataLen=0x18e0d0) returned 0 [0039.720] GetLastError () returned 0xea [0039.721] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e072c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.721] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.721] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1800*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1800*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.722] SetEndOfFile (hFile=0x10c) returned 1 [0039.722] CloseHandle (hObject=0x10c) returned 1 [0039.722] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.722] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.722] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.723] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.723] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8293590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.723] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.723] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.723] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.723] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0039.723] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.723] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.723] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.723] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.723] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.723] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2998*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2998, pdwDataLen=0x18e0d0) returned 0 [0039.723] GetLastError () returned 0xea [0039.723] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2998*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2998*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.724] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.724] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d4c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d4c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.725] SetEndOfFile (hFile=0x10c) returned 1 [0039.725] CloseHandle (hObject=0x10c) returned 1 [0039.725] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.725] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.725] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.726] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.726] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8293590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8293590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8293590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.726] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.726] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.726] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.726] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_HK", cAlternateFileName="")) returned 1 [0039.726] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.727] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.727] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.727] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.727] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.727] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17e8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17e8, pdwDataLen=0x18e0d0) returned 0 [0039.727] GetLastError () returned 0xea [0039.727] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17e8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17e8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.727] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.727] WriteFile (in: hFile=0x10c, lpBuffer=0x33f254c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f254c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.728] SetEndOfFile (hFile=0x10c) returned 1 [0039.728] CloseHandle (hObject=0x10c) returned 1 [0039.728] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.728] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.728] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.729] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.729] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82b96f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.729] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.729] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.729] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.729] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0039.729] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.730] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.730] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.730] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.730] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0039.730] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1da4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1da4, pdwDataLen=0x18e0d0) returned 0 [0039.730] GetLastError () returned 0xea [0039.730] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1da4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1da4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.730] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.730] WriteFile (in: hFile=0x10c, lpBuffer=0x33f27bc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f27bc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.731] SetEndOfFile (hFile=0x10c) returned 1 [0039.731] CloseHandle (hObject=0x10c) returned 1 [0039.731] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.731] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.731] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.732] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.732] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82b96f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.732] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.732] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.732] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.732] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zu", cAlternateFileName="")) returned 1 [0039.732] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.733] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.733] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.733] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0039.733] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.733] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17c0, pdwDataLen=0x18e0d0) returned 0 [0039.733] GetLastError () returned 0xea [0039.733] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.733] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.733] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2110*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2110*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.734] SetEndOfFile (hFile=0x10c) returned 1 [0039.734] CloseHandle (hObject=0x10c) returned 1 [0039.734] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.735] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.735] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.735] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.735] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82b96f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.735] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.735] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fedf50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.735] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.735] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fec7e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fec7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fec7e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zu", cAlternateFileName="")) returned 0 [0039.735] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.735] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0039.735] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0039.736] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0039.736] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.736] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c90c0) returned 1 [0039.736] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.736] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2018*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33e2018, pdwDataLen=0x18e338) returned 0 [0039.736] GetLastError () returned 0xea [0039.736] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2018*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33e2018*, pdwDataLen=0x18e334*=0x260) returned 1 [0039.736] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.738] WriteFile (in: hFile=0x100, lpBuffer=0x33f22c0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33f22c0*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0039.739] SetEndOfFile (hFile=0x100) returned 1 [0039.739] CloseHandle (hObject=0x100) returned 1 [0039.739] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.739] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.739] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.739] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.739] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8636e710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0039.740] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82b96f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.740] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0039.740] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86012940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x4454, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0039.740] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.740] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86012940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8636e710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8636e710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0039.740] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.740] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80a43b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x69726373, dwReserved1=0x6a2e7470, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.740] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa80a43b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa80a43b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa80a43b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x69726373, dwReserved1=0x6a2e7470, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0039.740] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0039.740] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa73b2c10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa73b2c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa73b2c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.740] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82abeb90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82abeb90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="nmmhkkegccagdldgiimedpiccmgmieda", cAlternateFileName="NMMHKK~1")) returned 1 [0039.740] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0039.741] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0039.741] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.741] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9180) returned 1 [0039.741] CryptDestroyHash (hHash=0x5c9200) returned 1 [0039.741] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1228*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e1228, pdwDataLen=0x18e808) returned 0 [0039.741] GetLastError () returned 0xea [0039.741] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1228*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e1228*, pdwDataLen=0x18e804*=0x260) returned 1 [0039.741] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0039.741] WriteFile (in: hFile=0x104, lpBuffer=0x33f25fc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33f25fc*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0039.743] SetEndOfFile (hFile=0x104) returned 1 [0039.743] CloseHandle (hObject=0x104) returned 1 [0039.743] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.743] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.743] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.743] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82ab7660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82b96f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.743] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e7880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e7880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1.0.0.2_0", cAlternateFileName="100~1.2_0")) returned 1 [0039.743] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0039.744] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0039.744] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.744] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c90c0) returned 1 [0039.744] CryptDestroyHash (hHash=0x5c9200) returned 1 [0039.744] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e5a0) returned 0 [0039.744] GetLastError () returned 0xea [0039.744] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e59c*=0x260) returned 1 [0039.744] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.745] WriteFile (in: hFile=0xfc, lpBuffer=0x33e1110*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33e1110*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0039.745] SetEndOfFile (hFile=0xfc) returned 1 [0039.746] CloseHandle (hObject=0xfc) returned 1 [0039.746] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.746] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.746] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82651e90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.746] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82888510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8288ac20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x32a2e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="craw_background.js", cAlternateFileName="CRAW_B~1.JS")) returned 1 [0039.746] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8288d330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82892150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xba221600, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x3b059, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="craw_window.js", cAlternateFileName="CRAW_W~1.JS")) returned 1 [0039.746] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="css", cAlternateFileName="")) returned 1 [0039.746] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0039.747] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0039.747] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.747] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c91c0) returned 1 [0039.747] CryptDestroyHash (hHash=0x5c9200) returned 1 [0039.747] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e338) returned 0 [0039.747] GetLastError () returned 0xea [0039.747] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e334*=0x260) returned 1 [0039.747] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.747] WriteFile (in: hFile=0x100, lpBuffer=0x33e1960*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33e1960*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0039.748] SetEndOfFile (hFile=0x100) returned 1 [0039.748] CloseHandle (hObject=0x100) returned 1 [0039.749] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.749] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.749] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.749] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.749] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 1 [0039.749] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82df850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.749] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82df850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0039.749] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.749] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82df850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.749] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828a0bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="html", cAlternateFileName="")) returned 1 [0039.749] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0039.750] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0039.750] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.750] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c9200) returned 1 [0039.750] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.750] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11d0*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33e11d0, pdwDataLen=0x18e338) returned 0 [0039.750] GetLastError () returned 0xea [0039.750] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11d0*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33e11d0*, pdwDataLen=0x18e334*=0x260) returned 1 [0039.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.750] WriteFile (in: hFile=0x100, lpBuffer=0x33e1f54*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33e1f54*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0039.751] SetEndOfFile (hFile=0x100) returned 1 [0039.751] CloseHandle (hObject=0x100) returned 1 [0039.752] CryptDestroyKey (hKey=0x5c9200) returned 1 [0039.752] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.752] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0039.752] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8289e4a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.752] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a0bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828a0bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="craw_window.html", cAlternateFileName="CRAW_W~1.HTM")) returned 1 [0039.752] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82df850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.752] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82df850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0039.752] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0039.752] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa25718d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa25718d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="images", cAlternateFileName="")) returned 1 [0039.752] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0039.753] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0039.753] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.753] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c91c0) returned 1 [0039.753] CryptDestroyHash (hHash=0x5c9200) returned 1 [0039.753] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f17c0, pdwDataLen=0x18e338) returned 0 [0039.753] GetLastError () returned 0xea [0039.753] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f17c0*, pdwDataLen=0x18e334*=0x260) returned 1 [0039.753] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.753] WriteFile (in: hFile=0x100, lpBuffer=0x33e22a0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33e22a0*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0039.754] SetEndOfFile (hFile=0x100) returned 1 [0039.754] CloseHandle (hObject=0x100) returned 1 [0039.754] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.754] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.755] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828a32c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828a80e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828aa7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe7591500, ftLastWriteTime.dwHighDateTime=0x1ce931e, nFileSizeHigh=0x0, nFileSizeLow=0x112dc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="flapper.gif", cAlternateFileName="")) returned 1 [0039.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82df850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2525610, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2525610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2525610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1109, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="icon_128.png.crypt", cAlternateFileName="ICON_1~1.CRY")) returned 1 [0039.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2525610, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2525610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2525610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="icon_16.png.crypt", cAlternateFileName="ICON_1~2.CRY")) returned 1 [0039.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa254b770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa254b770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa254b770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="topbar_floating_button.png.crypt", cAlternateFileName="TOPBAR~1.CRY")) returned 1 [0039.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa254b770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa254b770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa254b770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="topbar_floating_button_close.png.crypt", cAlternateFileName="TOPBAR~2.CRY")) returned 1 [0039.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa254b770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa254b770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa254b770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="topbar_floating_button_hover.png.crypt", cAlternateFileName="TOPBAR~3.CRY")) returned 1 [0039.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa25718d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa25718d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa25718d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="topbar_floating_button_maximize.png.crypt", cAlternateFileName="TOPBAR~4.CRY")) returned 1 [0039.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa25718d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa25718d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa25718d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="topbar_floating_button_pressed.png.crypt", cAlternateFileName="TOE51D~1.CRY")) returned 1 [0039.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa25718d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa25718d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa25718d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="topbar_floating_button_pressed.png.crypt", cAlternateFileName="TOE51D~1.CRY")) returned 0 [0039.755] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.755] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826545a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e2a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aa3de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x676e6974, dwReserved1=0x7475625f, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0039.755] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828836f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828836f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6974, dwReserved1=0x7475625f, cFileName="_locales", cAlternateFileName="")) returned 1 [0039.755] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0039.756] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0039.756] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.756] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c9200) returned 1 [0039.756] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.756] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1dcc*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f1dcc, pdwDataLen=0x18e338) returned 0 [0039.756] GetLastError () returned 0xea [0039.756] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1dcc*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f1dcc*, pdwDataLen=0x18e334*=0x260) returned 1 [0039.756] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.757] WriteFile (in: hFile=0x100, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0039.758] SetEndOfFile (hFile=0x100) returned 1 [0039.758] CloseHandle (hObject=0x100) returned 1 [0039.758] CryptDestroyKey (hKey=0x5c9200) returned 1 [0039.758] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.758] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0039.758] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82665710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.758] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="bg", cAlternateFileName="")) returned 1 [0039.759] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.759] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.759] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.759] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.759] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.759] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.759] GetLastError () returned 0xea [0039.759] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.759] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.761] WriteFile (in: hFile=0x10c, lpBuffer=0x33e181c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e181c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.762] SetEndOfFile (hFile=0x10c) returned 1 [0039.762] CloseHandle (hObject=0x10c) returned 1 [0039.762] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.762] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.762] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83059b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83059b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.762] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83059b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83059b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.762] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83059b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83059b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83059b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.762] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.762] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.762] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.762] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ca", cAlternateFileName="")) returned 1 [0039.762] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.763] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.763] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.763] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.763] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.763] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1200*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1200, pdwDataLen=0x18e0d0) returned 0 [0039.763] GetLastError () returned 0xea [0039.763] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1200*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1200*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.763] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.764] WriteFile (in: hFile=0x10c, lpBuffer=0x33e17c4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e17c4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.767] SetEndOfFile (hFile=0x10c) returned 1 [0039.767] CloseHandle (hObject=0x10c) returned 1 [0039.767] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.767] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.767] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83059b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83059b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.767] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83059b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83059b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.767] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83059b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83059b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83059b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.767] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.767] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.767] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.767] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="cs", cAlternateFileName="")) returned 1 [0039.767] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.768] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.768] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.768] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.768] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.768] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f5c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2f5c, pdwDataLen=0x18e0d0) returned 0 [0039.768] GetLastError () returned 0xea [0039.768] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f5c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2f5c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.768] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.769] WriteFile (in: hFile=0x10c, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.770] SetEndOfFile (hFile=0x10c) returned 1 [0039.770] CloseHandle (hObject=0x10c) returned 1 [0039.770] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.770] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.770] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83059b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83059b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.770] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83059b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83059b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.770] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83059b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83059b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83059b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.770] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.770] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.770] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.770] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="da", cAlternateFileName="")) returned 1 [0039.770] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.771] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.771] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.771] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.771] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.771] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22c8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f22c8, pdwDataLen=0x18e0d0) returned 0 [0039.771] GetLastError () returned 0xea [0039.771] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22c8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f22c8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.771] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.772] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2060*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2060*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.773] SetEndOfFile (hFile=0x10c) returned 1 [0039.773] CloseHandle (hObject=0x10c) returned 1 [0039.778] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.778] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.778] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83059b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83059b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.779] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83059b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83059b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.779] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83059b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83059b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83059b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.779] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.779] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.779] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.779] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="de", cAlternateFileName="")) returned 1 [0039.779] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.779] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.779] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.779] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.779] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.779] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.779] GetLastError () returned 0xea [0039.779] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.780] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.780] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2080*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2080*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.781] SetEndOfFile (hFile=0x10c) returned 1 [0039.781] CloseHandle (hObject=0x10c) returned 1 [0039.781] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.781] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.781] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa832bb10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa832bb10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.782] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa832bb10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa832bb10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.782] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa832bb10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa832bb10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa832bb10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.782] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.782] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.782] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.782] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="el", cAlternateFileName="")) returned 1 [0039.782] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.782] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.782] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.782] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.782] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.782] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1200*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1200, pdwDataLen=0x18e0d0) returned 0 [0039.782] GetLastError () returned 0xea [0039.782] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1200*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1200*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.783] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.783] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1468*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.784] SetEndOfFile (hFile=0x10c) returned 1 [0039.784] CloseHandle (hObject=0x10c) returned 1 [0039.784] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.784] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.784] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa832bb10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa832bb10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.785] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa832bb10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa832bb10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.785] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa832bb10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa832bb10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa832bb10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.785] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.785] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.785] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.785] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en", cAlternateFileName="")) returned 1 [0039.785] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.785] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.785] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.785] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.785] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.785] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11f0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e11f0, pdwDataLen=0x18e0d0) returned 0 [0039.786] GetLastError () returned 0xea [0039.786] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11f0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e11f0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.786] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.786] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.787] SetEndOfFile (hFile=0x10c) returned 1 [0039.787] CloseHandle (hObject=0x10c) returned 1 [0039.787] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.787] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.787] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa832bb10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa832bb10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.788] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa832bb10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa832bb10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.788] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa832bb10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa832bb10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa832bb10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.788] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.788] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.788] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.788] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en_GB", cAlternateFileName="")) returned 1 [0039.788] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.789] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.789] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.789] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.789] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.789] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17d4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17d4, pdwDataLen=0x18e0d0) returned 0 [0039.789] GetLastError () returned 0xea [0039.789] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17d4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17d4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.789] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.790] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2558*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2558*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.791] SetEndOfFile (hFile=0x10c) returned 1 [0039.791] CloseHandle (hObject=0x10c) returned 1 [0039.791] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.791] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.791] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.791] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.791] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8351c70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.791] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.791] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.791] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.791] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es", cAlternateFileName="")) returned 1 [0039.791] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.792] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.792] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.792] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.792] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.792] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1dd0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1dd0, pdwDataLen=0x18e0d0) returned 0 [0039.792] GetLastError () returned 0xea [0039.792] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1dd0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1dd0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.792] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.793] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2e90*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2e90*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.794] SetEndOfFile (hFile=0x10c) returned 1 [0039.794] CloseHandle (hObject=0x10c) returned 1 [0039.794] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.794] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.794] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.794] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.794] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8351c70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.794] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.794] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.794] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.794] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es_419", cAlternateFileName="")) returned 1 [0039.794] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.795] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.795] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.795] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.795] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.795] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11e0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e11e0, pdwDataLen=0x18e0d0) returned 0 [0039.795] GetLastError () returned 0xea [0039.795] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11e0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e11e0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.795] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.796] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2d38*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2d38*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.797] SetEndOfFile (hFile=0x10c) returned 1 [0039.797] CloseHandle (hObject=0x10c) returned 1 [0039.797] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.797] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.797] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.797] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8351c70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.797] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.797] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.797] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.797] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="et", cAlternateFileName="")) returned 1 [0039.797] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.798] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.798] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.798] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.798] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.798] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2720*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2720, pdwDataLen=0x18e0d0) returned 0 [0039.798] GetLastError () returned 0xea [0039.798] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2720*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2720*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.798] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.799] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.800] SetEndOfFile (hFile=0x10c) returned 1 [0039.800] CloseHandle (hObject=0x10c) returned 1 [0039.800] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.800] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.800] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.800] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.800] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8351c70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.801] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.801] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.801] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.801] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fi", cAlternateFileName="")) returned 1 [0039.801] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.801] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.801] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.801] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.801] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.801] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.801] GetLastError () returned 0xea [0039.801] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.802] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.802] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.803] SetEndOfFile (hFile=0x10c) returned 1 [0039.803] CloseHandle (hObject=0x10c) returned 1 [0039.803] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.803] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.803] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.804] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.804] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8351c70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8351c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8351c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.804] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.804] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.804] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.804] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fil", cAlternateFileName="")) returned 1 [0039.804] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.805] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.805] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.805] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.805] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.805] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.805] GetLastError () returned 0xea [0039.805] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.805] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.806] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1ba8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1ba8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.806] SetEndOfFile (hFile=0x10c) returned 1 [0039.807] CloseHandle (hObject=0x10c) returned 1 [0039.807] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.807] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.807] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.807] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.807] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8377dd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.807] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.807] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.807] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.807] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fr", cAlternateFileName="")) returned 1 [0039.807] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.808] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.808] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.808] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.808] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.808] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e159c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e159c, pdwDataLen=0x18e0d0) returned 0 [0039.808] GetLastError () returned 0xea [0039.808] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e159c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e159c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.808] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.809] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1fb4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1fb4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.809] SetEndOfFile (hFile=0x10c) returned 1 [0039.810] CloseHandle (hObject=0x10c) returned 1 [0039.810] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.810] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.810] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.810] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.810] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8377dd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.810] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.810] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.810] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.810] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hi", cAlternateFileName="")) returned 1 [0039.810] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.811] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.811] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.811] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.811] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.811] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e158c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e158c, pdwDataLen=0x18e0d0) returned 0 [0039.811] GetLastError () returned 0xea [0039.811] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e158c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e158c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.811] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.812] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1fa4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1fa4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.813] SetEndOfFile (hFile=0x10c) returned 1 [0039.813] CloseHandle (hObject=0x10c) returned 1 [0039.813] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.813] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.813] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.813] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.813] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8377dd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.813] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.813] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.813] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.813] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82df850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82df850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83059b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.813] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hr", cAlternateFileName="")) returned 1 [0039.813] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.814] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.814] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.814] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.814] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.814] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1ed4*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1ed4, pdwDataLen=0x18e0d0) returned 0 [0039.814] GetLastError () returned 0xea [0039.814] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1ed4*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1ed4*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.814] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.815] WriteFile (in: hFile=0x10c, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.815] SetEndOfFile (hFile=0x10c) returned 1 [0039.816] CloseHandle (hObject=0x10c) returned 1 [0039.816] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.816] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.816] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.816] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.816] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8377dd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.816] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.816] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.816] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.816] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hu", cAlternateFileName="")) returned 1 [0039.816] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.817] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.817] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.817] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.817] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.817] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.817] GetLastError () returned 0xea [0039.817] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.817] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.818] WriteFile (in: hFile=0x10c, lpBuffer=0x33e185c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e185c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.819] SetEndOfFile (hFile=0x10c) returned 1 [0039.819] CloseHandle (hObject=0x10c) returned 1 [0039.819] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.819] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.819] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.819] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.819] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8377dd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8377dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8377dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.819] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.819] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.819] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.819] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="id", cAlternateFileName="")) returned 1 [0039.819] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.820] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.820] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.820] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.820] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.820] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1250*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1250, pdwDataLen=0x18e0d0) returned 0 [0039.820] GetLastError () returned 0xea [0039.820] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1250*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1250*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.820] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.821] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1814*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1814*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.822] SetEndOfFile (hFile=0x10c) returned 1 [0039.822] CloseHandle (hObject=0x10c) returned 1 [0039.822] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.822] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.822] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.822] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.822] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa839df30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.822] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.822] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.822] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.822] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="it", cAlternateFileName="")) returned 1 [0039.822] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.823] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.823] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.823] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.823] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.823] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f0c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2f0c, pdwDataLen=0x18e0d0) returned 0 [0039.823] GetLastError () returned 0xea [0039.823] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f0c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2f0c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.823] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.824] WriteFile (in: hFile=0x10c, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.825] SetEndOfFile (hFile=0x10c) returned 1 [0039.825] CloseHandle (hObject=0x10c) returned 1 [0039.825] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.825] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.825] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.825] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.825] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa839df30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.825] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.825] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.825] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.825] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ja", cAlternateFileName="")) returned 1 [0039.826] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.826] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.826] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.826] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.826] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.826] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22c8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f22c8, pdwDataLen=0x18e0d0) returned 0 [0039.826] GetLastError () returned 0xea [0039.826] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22c8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f22c8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.827] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.827] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2060*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2060*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.828] SetEndOfFile (hFile=0x10c) returned 1 [0039.828] CloseHandle (hObject=0x10c) returned 1 [0039.828] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.828] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.828] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.828] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.828] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa839df30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.829] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.829] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.829] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.829] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ko", cAlternateFileName="")) returned 1 [0039.829] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.829] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.829] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.829] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.829] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.829] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.829] GetLastError () returned 0xea [0039.829] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.830] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.830] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2080*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2080*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.831] SetEndOfFile (hFile=0x10c) returned 1 [0039.831] CloseHandle (hObject=0x10c) returned 1 [0039.831] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.831] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.831] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.831] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.831] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa839df30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.832] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.832] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.832] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.832] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lt", cAlternateFileName="")) returned 1 [0039.832] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.832] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.832] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.832] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.832] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.832] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1200*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1200, pdwDataLen=0x18e0d0) returned 0 [0039.832] GetLastError () returned 0xea [0039.832] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1200*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1200*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.833] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.833] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1468*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.834] SetEndOfFile (hFile=0x10c) returned 1 [0039.834] CloseHandle (hObject=0x10c) returned 1 [0039.834] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.834] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.834] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.835] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.835] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa839df30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa839df30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa839df30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.835] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.835] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.835] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.835] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lv", cAlternateFileName="")) returned 1 [0039.835] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.836] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.836] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.836] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.836] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.836] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11f0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e11f0, pdwDataLen=0x18e0d0) returned 0 [0039.836] GetLastError () returned 0xea [0039.836] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11f0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e11f0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.837] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.837] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.838] SetEndOfFile (hFile=0x10c) returned 1 [0039.838] CloseHandle (hObject=0x10c) returned 1 [0039.838] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.838] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.838] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.838] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.838] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83c4090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.839] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.839] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.839] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.839] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="nb", cAlternateFileName="")) returned 1 [0039.839] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.839] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.839] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.839] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.839] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.839] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17bc, pdwDataLen=0x18e0d0) returned 0 [0039.839] GetLastError () returned 0xea [0039.839] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17bc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.840] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.840] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2540*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2540*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.841] SetEndOfFile (hFile=0x10c) returned 1 [0039.841] CloseHandle (hObject=0x10c) returned 1 [0039.841] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.841] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.841] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.842] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.842] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83c4090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.842] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.842] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.842] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.842] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="nl", cAlternateFileName="")) returned 1 [0039.842] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.842] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.842] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.842] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.842] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.842] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1db8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1db8, pdwDataLen=0x18e0d0) returned 0 [0039.842] GetLastError () returned 0xea [0039.842] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1db8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1db8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.843] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.843] WriteFile (in: hFile=0x10c, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.844] SetEndOfFile (hFile=0x10c) returned 1 [0039.844] CloseHandle (hObject=0x10c) returned 1 [0039.844] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.844] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.844] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.845] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.845] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83c4090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.845] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.845] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.845] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.845] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pl", cAlternateFileName="")) returned 1 [0039.845] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.845] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.845] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.845] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.845] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.845] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.845] GetLastError () returned 0xea [0039.846] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.846] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.846] WriteFile (in: hFile=0x10c, lpBuffer=0x33f21c4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f21c4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.847] SetEndOfFile (hFile=0x10c) returned 1 [0039.847] CloseHandle (hObject=0x10c) returned 1 [0039.847] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.847] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.847] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.848] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.848] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83c4090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.848] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.848] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.848] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.848] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0039.848] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.848] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.848] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.849] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.849] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.849] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1204*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1204, pdwDataLen=0x18e0d0) returned 0 [0039.849] GetLastError () returned 0xea [0039.849] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1204*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1204*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.849] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.849] WriteFile (in: hFile=0x10c, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.850] SetEndOfFile (hFile=0x10c) returned 1 [0039.850] CloseHandle (hObject=0x10c) returned 1 [0039.850] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.850] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.850] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.851] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.851] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83c4090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83c4090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83c4090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.851] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.851] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.851] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.851] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0039.851] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.851] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.851] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.852] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.852] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.852] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11e0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e11e0, pdwDataLen=0x18e0d0) returned 0 [0039.852] GetLastError () returned 0xea [0039.852] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11e0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e11e0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.852] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.852] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1448*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1448*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.853] SetEndOfFile (hFile=0x10c) returned 1 [0039.853] CloseHandle (hObject=0x10c) returned 1 [0039.853] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.853] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.853] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.854] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.854] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83ea1f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.854] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.854] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.854] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.854] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ro", cAlternateFileName="")) returned 1 [0039.854] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.854] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.855] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.855] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.855] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.855] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11e0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e11e0, pdwDataLen=0x18e0d0) returned 0 [0039.855] GetLastError () returned 0xea [0039.855] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11e0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e11e0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.855] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.855] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.856] SetEndOfFile (hFile=0x10c) returned 1 [0039.856] CloseHandle (hObject=0x10c) returned 1 [0039.856] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.856] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.856] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.857] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.857] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83ea1f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.857] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.857] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.857] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.857] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ru", cAlternateFileName="")) returned 1 [0039.857] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.857] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.857] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.858] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.858] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.858] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1e20*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1e20, pdwDataLen=0x18e0d0) returned 0 [0039.858] GetLastError () returned 0xea [0039.858] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1e20*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1e20*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.858] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.858] WriteFile (in: hFile=0x10c, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.859] SetEndOfFile (hFile=0x10c) returned 1 [0039.859] CloseHandle (hObject=0x10c) returned 1 [0039.859] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.859] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.859] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.860] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.860] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83ea1f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.860] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.860] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.860] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.860] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sk", cAlternateFileName="")) returned 1 [0039.860] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.860] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.860] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.860] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.861] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.861] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20b0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e20b0, pdwDataLen=0x18e0d0) returned 0 [0039.861] GetLastError () returned 0xea [0039.861] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20b0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e20b0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.861] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.861] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.862] SetEndOfFile (hFile=0x10c) returned 1 [0039.862] CloseHandle (hObject=0x10c) returned 1 [0039.862] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.862] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.862] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.863] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.863] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83ea1f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.863] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.863] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.863] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.863] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sl", cAlternateFileName="")) returned 1 [0039.863] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.863] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.863] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.863] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.864] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.864] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11e0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e11e0, pdwDataLen=0x18e0d0) returned 0 [0039.864] GetLastError () returned 0xea [0039.864] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11e0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e11e0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.864] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.864] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1f64*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1f64*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.865] SetEndOfFile (hFile=0x10c) returned 1 [0039.865] CloseHandle (hObject=0x10c) returned 1 [0039.865] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.865] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.865] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.866] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.866] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa83ea1f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa83ea1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa83ea1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.866] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.866] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.866] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.866] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sr", cAlternateFileName="")) returned 1 [0039.866] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.866] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.866] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.867] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.867] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.867] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17cc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17cc, pdwDataLen=0x18e0d0) returned 0 [0039.867] GetLastError () returned 0xea [0039.867] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17cc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17cc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.867] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.868] WriteFile (in: hFile=0x10c, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.869] SetEndOfFile (hFile=0x10c) returned 1 [0039.869] CloseHandle (hObject=0x10c) returned 1 [0039.869] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.869] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.869] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.869] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.869] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8410350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.869] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.869] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.869] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.869] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sv", cAlternateFileName="")) returned 1 [0039.869] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.870] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.870] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.870] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.870] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.870] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a4c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1a4c, pdwDataLen=0x18e0d0) returned 0 [0039.870] GetLastError () returned 0xea [0039.870] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a4c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1a4c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.870] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.871] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.872] SetEndOfFile (hFile=0x10c) returned 1 [0039.872] CloseHandle (hObject=0x10c) returned 1 [0039.872] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.872] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.872] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.872] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.872] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8410350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.872] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.872] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.872] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.872] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="th", cAlternateFileName="")) returned 1 [0039.872] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.873] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.873] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.873] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.873] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.873] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11e0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e11e0, pdwDataLen=0x18e0d0) returned 0 [0039.873] GetLastError () returned 0xea [0039.873] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e11e0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e11e0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.873] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.874] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.875] SetEndOfFile (hFile=0x10c) returned 1 [0039.875] CloseHandle (hObject=0x10c) returned 1 [0039.875] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.875] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.875] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.875] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.875] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8410350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.875] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.875] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.875] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.875] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="tr", cAlternateFileName="")) returned 1 [0039.875] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.876] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.876] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.876] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.876] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.876] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17cc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17cc, pdwDataLen=0x18e0d0) returned 0 [0039.876] GetLastError () returned 0xea [0039.876] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17cc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17cc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.876] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.877] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2540*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2540*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.878] SetEndOfFile (hFile=0x10c) returned 1 [0039.878] CloseHandle (hObject=0x10c) returned 1 [0039.878] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.878] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.878] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.878] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.878] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8410350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.878] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.878] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.878] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.878] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="uk", cAlternateFileName="")) returned 1 [0039.878] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.879] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.879] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.879] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.879] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.879] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1da8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1da8, pdwDataLen=0x18e0d0) returned 0 [0039.879] GetLastError () returned 0xea [0039.879] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1da8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1da8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.880] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.881] SetEndOfFile (hFile=0x10c) returned 1 [0039.881] CloseHandle (hObject=0x10c) returned 1 [0039.881] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.881] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.881] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.881] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.881] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8410350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8410350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8410350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.881] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.881] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.881] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.881] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="vi", cAlternateFileName="")) returned 1 [0039.881] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.882] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.882] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.882] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.883] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.883] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d98*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d98, pdwDataLen=0x18e0d0) returned 0 [0039.883] GetLastError () returned 0xea [0039.883] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d98*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d98*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.883] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.883] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2e88*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2e88*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.884] SetEndOfFile (hFile=0x10c) returned 1 [0039.884] CloseHandle (hObject=0x10c) returned 1 [0039.885] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.885] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.885] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.885] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.885] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84364b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.885] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.885] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.885] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.885] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0039.885] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.886] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.886] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.886] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.886] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0039.886] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1208*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1208, pdwDataLen=0x18e0d0) returned 0 [0039.886] GetLastError () returned 0xea [0039.886] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1208*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1208*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.886] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.886] WriteFile (in: hFile=0x10c, lpBuffer=0x33f26d8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f26d8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.887] SetEndOfFile (hFile=0x10c) returned 1 [0039.887] CloseHandle (hObject=0x10c) returned 1 [0039.887] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.887] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.887] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.888] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.888] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84364b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.888] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.888] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.888] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.888] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0039.888] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.889] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.889] CryptHashData (hHash=0x5c9080, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.889] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c91c0) returned 1 [0039.889] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.889] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17c0, pdwDataLen=0x18e0d0) returned 0 [0039.889] GetLastError () returned 0xea [0039.889] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17c0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.889] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2544*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2544*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.890] SetEndOfFile (hFile=0x10c) returned 1 [0039.890] CloseHandle (hObject=0x10c) returned 1 [0039.890] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.890] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.890] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.891] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.891] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84364b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.891] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.891] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.891] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.891] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0039.891] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0039.891] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0039.891] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0039.892] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0039.892] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.892] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c91c0) returned 1 [0039.892] CryptDestroyHash (hHash=0x5c9200) returned 1 [0039.892] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1dcc*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f1dcc, pdwDataLen=0x18e338) returned 0 [0039.892] GetLastError () returned 0xea [0039.892] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1dcc*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f1dcc*, pdwDataLen=0x18e334*=0x260) returned 1 [0039.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.893] WriteFile (in: hFile=0x100, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0039.894] SetEndOfFile (hFile=0x100) returned 1 [0039.894] CloseHandle (hObject=0x100) returned 1 [0039.894] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.894] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.894] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.894] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.894] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84364b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.894] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0039.894] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828e9f90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb7bfbc00, ftLastWriteTime.dwHighDateTime=0x1d297b0, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0039.894] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0039.894] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0039.894] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0039.894] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82b96f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.894] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa82b96f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa82b96f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa82df850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0039.894] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.894] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9174a630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9174a630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="pjkljhegncpnkpknbcohdijeoejaedia", cAlternateFileName="PJKLJH~1")) returned 1 [0039.894] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0039.895] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0039.895] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.895] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c90c0) returned 1 [0039.895] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.895] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e808) returned 0 [0039.895] GetLastError () returned 0xea [0039.895] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e804*=0x260) returned 1 [0039.895] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0039.896] WriteFile (in: hFile=0x104, lpBuffer=0x33e0ea0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33e0ea0*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0039.897] SetEndOfFile (hFile=0x104) returned 1 [0039.897] CloseHandle (hObject=0x104) returned 1 [0039.897] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0039.897] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.897] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0039.897] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x814d6d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.897] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa25e3cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa25e3cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8.1_0", cAlternateFileName="")) returned 1 [0039.897] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0039.898] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0039.898] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.898] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c91c0) returned 1 [0039.898] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.898] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0ee0*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0ee0, pdwDataLen=0x18e5a0) returned 0 [0039.898] GetLastError () returned 0xea [0039.898] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0ee0*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e0ee0*, pdwDataLen=0x18e59c*=0x260) returned 1 [0039.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0039.899] WriteFile (in: hFile=0xfc, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0039.899] SetEndOfFile (hFile=0xfc) returned 1 [0039.899] CloseHandle (hObject=0xfc) returned 1 [0039.900] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0039.900] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0039.900] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.900] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa25e3cf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa25e3cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa25e3cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x180f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="128.png.crypt", cAlternateFileName="128PNG~1.CRY")) returned 1 [0039.900] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa845c610, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.900] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x869b0fb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0039.900] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_locales", cAlternateFileName="")) returned 1 [0039.900] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0039.901] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0039.901] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.901] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c9200) returned 1 [0039.901] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.901] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c34*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f2c34, pdwDataLen=0x18e338) returned 0 [0039.901] GetLastError () returned 0xea [0039.901] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c34*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f2c34*, pdwDataLen=0x18e334*=0x260) returned 1 [0039.901] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0039.902] WriteFile (in: hFile=0x100, lpBuffer=0x33e1578*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33e1578*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0039.903] SetEndOfFile (hFile=0x100) returned 1 [0039.903] CloseHandle (hObject=0x100) returned 1 [0039.903] CryptDestroyKey (hKey=0x5c9200) returned 1 [0039.903] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0039.903] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.903] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ar", cAlternateFileName="")) returned 1 [0039.903] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.904] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.904] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.904] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.904] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.904] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c1c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2c1c, pdwDataLen=0x18e0d0) returned 0 [0039.904] GetLastError () returned 0xea [0039.904] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c1c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2c1c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.904] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.905] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2094*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2094*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.906] SetEndOfFile (hFile=0x10c) returned 1 [0039.906] CloseHandle (hObject=0x10c) returned 1 [0039.906] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.906] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.906] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.906] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa845c610, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.906] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.906] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.906] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.906] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="bg", cAlternateFileName="")) returned 1 [0039.907] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.907] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.907] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.907] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.907] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.907] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e191c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e191c, pdwDataLen=0x18e0d0) returned 0 [0039.907] GetLastError () returned 0xea [0039.907] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e191c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e191c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.908] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.908] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2f70*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2f70*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.909] SetEndOfFile (hFile=0x10c) returned 1 [0039.909] CloseHandle (hObject=0x10c) returned 1 [0039.909] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.909] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.909] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.909] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.909] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa845c610, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.909] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.909] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.909] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.909] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ca", cAlternateFileName="")) returned 1 [0039.910] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.910] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.910] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.910] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.910] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.910] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e190c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e190c, pdwDataLen=0x18e0d0) returned 0 [0039.910] GetLastError () returned 0xea [0039.910] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e190c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e190c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.911] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.911] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2f80*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2f80*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.912] SetEndOfFile (hFile=0x10c) returned 1 [0039.912] CloseHandle (hObject=0x10c) returned 1 [0039.912] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.912] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.912] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.912] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.912] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa845c610, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.912] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.912] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.912] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.912] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="cs", cAlternateFileName="")) returned 1 [0039.913] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.913] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.913] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.913] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.913] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.913] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0708, pdwDataLen=0x18e0d0) returned 0 [0039.913] GetLastError () returned 0xea [0039.913] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.914] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2f90*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2f90*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.915] SetEndOfFile (hFile=0x10c) returned 1 [0039.915] CloseHandle (hObject=0x10c) returned 1 [0039.915] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.915] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.915] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.915] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8482770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.915] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.916] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.916] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.916] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="da", cAlternateFileName="")) returned 1 [0039.916] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.916] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.916] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.916] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.916] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.916] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1474*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1474, pdwDataLen=0x18e0d0) returned 0 [0039.916] GetLastError () returned 0xea [0039.916] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1474*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1474*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.917] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.919] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1af0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1af0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.920] SetEndOfFile (hFile=0x10c) returned 1 [0039.920] CloseHandle (hObject=0x10c) returned 1 [0039.920] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.920] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.920] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.921] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.921] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8482770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.921] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.921] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.921] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.921] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="de", cAlternateFileName="")) returned 1 [0039.921] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.921] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.921] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.921] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.922] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.922] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e0d0) returned 0 [0039.922] GetLastError () returned 0xea [0039.922] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.922] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.922] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1f98*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1f98*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.924] SetEndOfFile (hFile=0x10c) returned 1 [0039.924] CloseHandle (hObject=0x10c) returned 1 [0039.924] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.924] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.924] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.924] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.924] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8482770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.924] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.924] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.924] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.924] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="el", cAlternateFileName="")) returned 1 [0039.924] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.925] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.925] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.925] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.925] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.925] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c3c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2c3c, pdwDataLen=0x18e0d0) returned 0 [0039.925] GetLastError () returned 0xea [0039.925] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c3c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2c3c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.925] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.926] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1af0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1af0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.927] SetEndOfFile (hFile=0x10c) returned 1 [0039.927] CloseHandle (hObject=0x10c) returned 1 [0039.927] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.927] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.927] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.927] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.927] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8482770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.927] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.927] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.927] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.927] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en", cAlternateFileName="")) returned 1 [0039.927] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.928] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.928] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.928] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.928] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.928] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1b4c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1b4c, pdwDataLen=0x18e0d0) returned 0 [0039.928] GetLastError () returned 0xea [0039.928] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1b4c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1b4c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.928] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.929] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1db4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1db4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.930] SetEndOfFile (hFile=0x10c) returned 1 [0039.930] CloseHandle (hObject=0x10c) returned 1 [0039.931] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.931] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.931] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.931] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8482770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.931] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8482770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8482770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84a88d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.931] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.931] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.931] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.931] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es", cAlternateFileName="")) returned 1 [0039.931] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.932] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.932] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.932] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.932] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.932] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1214*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1214, pdwDataLen=0x18e0d0) returned 0 [0039.932] GetLastError () returned 0xea [0039.932] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1214*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1214*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.932] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.933] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2f70*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2f70*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.934] SetEndOfFile (hFile=0x10c) returned 1 [0039.934] CloseHandle (hObject=0x10c) returned 1 [0039.934] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.934] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.934] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84a88d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84a88d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.934] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84a88d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84a88d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.934] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84a88d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84a88d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84a88d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.935] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.935] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.935] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.935] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fi", cAlternateFileName="")) returned 1 [0039.935] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.935] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.935] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.935] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.935] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.935] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f88*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2f88, pdwDataLen=0x18e0d0) returned 0 [0039.935] GetLastError () returned 0xea [0039.935] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f88*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2f88*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.936] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.937] WriteFile (in: hFile=0x10c, lpBuffer=0x33e14e4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e14e4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.938] SetEndOfFile (hFile=0x10c) returned 1 [0039.938] CloseHandle (hObject=0x10c) returned 1 [0039.938] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.938] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.938] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84a88d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84a88d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.938] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84a88d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84a88d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.938] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84a88d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84a88d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84a88d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.938] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.938] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.938] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.939] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fil", cAlternateFileName="")) returned 1 [0039.939] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.939] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.939] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.939] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.939] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.939] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f78*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2f78, pdwDataLen=0x18e0d0) returned 0 [0039.939] GetLastError () returned 0xea [0039.939] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f78*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2f78*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.940] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.940] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d8c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d8c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.941] SetEndOfFile (hFile=0x10c) returned 1 [0039.941] CloseHandle (hObject=0x10c) returned 1 [0039.942] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.942] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.942] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84a88d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84a88d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.942] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84a88d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84a88d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.942] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84a88d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84a88d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84a88d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.942] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.942] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.942] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.942] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fr", cAlternateFileName="")) returned 1 [0039.942] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.943] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.943] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.943] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.943] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.943] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f78*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2f78, pdwDataLen=0x18e0d0) returned 0 [0039.943] GetLastError () returned 0xea [0039.943] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2f78*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2f78*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.943] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.944] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.945] SetEndOfFile (hFile=0x10c) returned 1 [0039.945] CloseHandle (hObject=0x10c) returned 1 [0039.945] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.945] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.945] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84a88d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84a88d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.945] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84a88d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84a88d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.946] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84a88d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84a88d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84cea30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.946] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.946] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.946] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.946] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hi", cAlternateFileName="")) returned 1 [0039.946] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.946] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.946] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.946] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.946] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.946] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c1c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2c1c, pdwDataLen=0x18e0d0) returned 0 [0039.946] GetLastError () returned 0xea [0039.946] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c1c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2c1c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.947] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.947] WriteFile (in: hFile=0x10c, lpBuffer=0x33e19dc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e19dc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.948] SetEndOfFile (hFile=0x10c) returned 1 [0039.949] CloseHandle (hObject=0x10c) returned 1 [0039.949] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.949] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.949] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84cea30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84cea30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.949] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84cea30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84cea30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.949] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84cea30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84cea30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84cea30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.949] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.949] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.949] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.949] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa845c610, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa845c610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa845c610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.949] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hr", cAlternateFileName="")) returned 1 [0039.949] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.950] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.950] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.950] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.950] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.950] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b28*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1b28, pdwDataLen=0x18e0d0) returned 0 [0039.950] GetLastError () returned 0xea [0039.950] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b28*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1b28*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.951] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.952] SetEndOfFile (hFile=0x10c) returned 1 [0039.952] CloseHandle (hObject=0x10c) returned 1 [0039.953] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.953] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.953] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84cea30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84cea30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.953] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84cea30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84cea30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.953] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84cea30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84cea30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84cea30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.953] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.953] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.953] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.953] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hu", cAlternateFileName="")) returned 1 [0039.953] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.954] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.954] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.954] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.954] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.954] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.954] GetLastError () returned 0xea [0039.954] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.954] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.955] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d18*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d18*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.956] SetEndOfFile (hFile=0x10c) returned 1 [0039.956] CloseHandle (hObject=0x10c) returned 1 [0039.956] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.956] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.956] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84cea30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84cea30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.956] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84cea30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84cea30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.956] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84cea30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84cea30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84cea30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.957] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.957] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.957] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.957] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="id", cAlternateFileName="")) returned 1 [0039.957] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.957] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.957] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.957] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.957] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.957] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a4c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1a4c, pdwDataLen=0x18e0d0) returned 0 [0039.957] GetLastError () returned 0xea [0039.957] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a4c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1a4c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.958] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.958] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2064*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2064*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.959] SetEndOfFile (hFile=0x10c) returned 1 [0039.959] CloseHandle (hObject=0x10c) returned 1 [0039.960] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.960] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.960] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84cea30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84cea30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.960] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84cea30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84cea30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.960] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84cea30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84cea30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84cea30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.960] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.960] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.972] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.972] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="it", cAlternateFileName="")) returned 1 [0039.972] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.973] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.973] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.973] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.973] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.973] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a3c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1a3c, pdwDataLen=0x18e0d0) returned 0 [0039.973] GetLastError () returned 0xea [0039.973] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a3c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1a3c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.974] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.975] WriteFile (in: hFile=0x10c, lpBuffer=0x33f0058*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f0058*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.976] SetEndOfFile (hFile=0x10c) returned 1 [0039.976] CloseHandle (hObject=0x10c) returned 1 [0039.976] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.976] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.976] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84f4b90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84f4b90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.977] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa84f4b90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84f4b90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.977] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84f4b90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84f4b90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa851acf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.977] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.977] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.977] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.977] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ja", cAlternateFileName="")) returned 1 [0039.977] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.977] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.977] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.977] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.977] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.978] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.978] GetLastError () returned 0xea [0039.978] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.978] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.979] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d38*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d38*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.980] SetEndOfFile (hFile=0x10c) returned 1 [0039.980] CloseHandle (hObject=0x10c) returned 1 [0039.980] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.980] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.980] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa851acf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa851acf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.980] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa851acf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa851acf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.980] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa851acf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa851acf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa851acf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.980] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.980] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.980] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.981] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ko", cAlternateFileName="")) returned 1 [0039.981] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.981] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.981] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.981] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.981] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.981] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.981] GetLastError () returned 0xea [0039.981] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.982] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.982] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2094*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2094*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.983] SetEndOfFile (hFile=0x10c) returned 1 [0039.983] CloseHandle (hObject=0x10c) returned 1 [0039.984] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.984] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.984] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa851acf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa851acf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.984] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa851acf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa851acf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.984] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa851acf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa851acf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa851acf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.984] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.984] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.984] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.984] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lt", cAlternateFileName="")) returned 1 [0039.984] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.985] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.985] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.985] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.985] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.985] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0039.985] GetLastError () returned 0xea [0039.985] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.985] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.986] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2f70*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2f70*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.987] SetEndOfFile (hFile=0x10c) returned 1 [0039.987] CloseHandle (hObject=0x10c) returned 1 [0039.987] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.987] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.987] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa851acf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa851acf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.987] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa851acf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa851acf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.987] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa851acf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa851acf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa851acf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.987] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.987] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.988] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.988] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lv", cAlternateFileName="")) returned 1 [0039.988] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.988] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.988] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.988] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.988] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.988] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e192c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e192c, pdwDataLen=0x18e0d0) returned 0 [0039.988] GetLastError () returned 0xea [0039.988] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e192c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e192c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.989] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.989] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2f70*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2f70*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.990] SetEndOfFile (hFile=0x10c) returned 1 [0039.991] CloseHandle (hObject=0x10c) returned 1 [0039.991] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.991] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.991] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa851acf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa851acf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.991] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa851acf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa851acf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.991] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa851acf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa851acf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa851acf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.991] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.991] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.991] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.991] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="nl", cAlternateFileName="")) returned 1 [0039.991] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.992] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.992] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.992] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0039.992] CryptDestroyHash (hHash=0x5c9080) returned 1 [0039.992] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0708, pdwDataLen=0x18e0d0) returned 0 [0039.992] GetLastError () returned 0xea [0039.992] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0708*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.993] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2f80*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2f80*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.994] SetEndOfFile (hFile=0x10c) returned 1 [0039.995] CloseHandle (hObject=0x10c) returned 1 [0039.995] CryptDestroyKey (hKey=0x5c9180) returned 1 [0039.995] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.995] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8540e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8540e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0039.995] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8540e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8540e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.995] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8540e50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8540e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8540e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.995] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.995] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.995] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0039.995] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="no", cAlternateFileName="")) returned 1 [0039.995] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0039.996] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0039.996] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0039.996] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0039.996] CryptDestroyHash (hHash=0x5c9180) returned 1 [0039.996] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0988*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0988, pdwDataLen=0x18e0d0) returned 0 [0039.996] GetLastError () returned 0xea [0039.996] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0988*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0988*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0039.996] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0039.997] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1acc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1acc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0039.998] SetEndOfFile (hFile=0x10c) returned 1 [0039.998] CloseHandle (hObject=0x10c) returned 1 [0039.999] CryptDestroyKey (hKey=0x5c9080) returned 1 [0039.999] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0039.999] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8540e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8540e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0039.999] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8540e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8540e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0039.999] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8540e50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8540e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8540e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0039.999] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0039.999] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0039.999] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0039.999] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pl", cAlternateFileName="")) returned 1 [0039.999] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.000] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.000] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.000] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0040.000] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.000] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06f8, pdwDataLen=0x18e0d0) returned 0 [0040.000] GetLastError () returned 0xea [0040.000] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e06f8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.000] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.001] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1ab0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1ab0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.002] SetEndOfFile (hFile=0x10c) returned 1 [0040.002] CloseHandle (hObject=0x10c) returned 1 [0040.002] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.002] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.002] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8540e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8540e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.002] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8540e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8540e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.002] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8540e50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8540e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8540e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.002] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.003] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.003] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.003] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0040.003] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.003] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.003] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.003] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.003] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.003] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b80*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1b80, pdwDataLen=0x18e0d0) returned 0 [0040.003] GetLastError () returned 0xea [0040.003] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1b80*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1b80*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.004] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.004] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1e1c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1e1c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.005] SetEndOfFile (hFile=0x10c) returned 1 [0040.006] CloseHandle (hObject=0x10c) returned 1 [0040.006] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.006] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.006] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8540e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8540e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.006] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8540e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8540e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.006] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8540e50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8540e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8540e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.006] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.006] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.006] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.006] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0040.006] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.007] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.007] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.007] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0040.007] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.007] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0040.007] GetLastError () returned 0xea [0040.007] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.007] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.008] WriteFile (in: hFile=0x10c, lpBuffer=0x33e19bc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e19bc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.009] SetEndOfFile (hFile=0x10c) returned 1 [0040.009] CloseHandle (hObject=0x10c) returned 1 [0040.009] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.009] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.009] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.010] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.010] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8566fb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.010] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.010] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.010] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.010] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ro", cAlternateFileName="")) returned 1 [0040.010] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.010] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.010] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.010] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.011] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.011] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0040.011] GetLastError () returned 0xea [0040.011] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.012] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d08*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d08*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.013] SetEndOfFile (hFile=0x10c) returned 1 [0040.013] CloseHandle (hObject=0x10c) returned 1 [0040.013] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.013] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.013] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.013] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.013] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8566fb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.013] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.013] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.014] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.014] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ru", cAlternateFileName="")) returned 1 [0040.014] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.014] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.014] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.014] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0040.014] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.014] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0040.014] GetLastError () returned 0xea [0040.014] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.015] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.015] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d28*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d28*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.016] SetEndOfFile (hFile=0x10c) returned 1 [0040.017] CloseHandle (hObject=0x10c) returned 1 [0040.017] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.017] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.017] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.017] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.017] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8566fb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.017] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.017] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.017] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.017] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="se", cAlternateFileName="")) returned 1 [0040.017] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.018] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.018] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.018] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.018] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.018] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0040.018] GetLastError () returned 0xea [0040.018] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.019] WriteFile (in: hFile=0x10c, lpBuffer=0x33e19ac*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e19ac*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.020] SetEndOfFile (hFile=0x10c) returned 1 [0040.020] CloseHandle (hObject=0x10c) returned 1 [0040.020] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.020] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.020] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.021] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.021] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8566fb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.021] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.021] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.021] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.021] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sk", cAlternateFileName="")) returned 1 [0040.021] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.021] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.021] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.021] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0040.021] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.021] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a3c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1a3c, pdwDataLen=0x18e0d0) returned 0 [0040.022] GetLastError () returned 0xea [0040.022] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a3c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1a3c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.022] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.023] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d18*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d18*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.024] SetEndOfFile (hFile=0x10c) returned 1 [0040.024] CloseHandle (hObject=0x10c) returned 1 [0040.024] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.024] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.024] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.025] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8566fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.025] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8566fb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8566fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa858d110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.025] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.025] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.025] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.025] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sl", cAlternateFileName="")) returned 1 [0040.025] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.025] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.025] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.025] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.025] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.025] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0040.025] GetLastError () returned 0xea [0040.026] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.026] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.026] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2f70*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2f70*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.027] SetEndOfFile (hFile=0x10c) returned 1 [0040.028] CloseHandle (hObject=0x10c) returned 1 [0040.028] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.028] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.028] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa858d110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa858d110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.028] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa858d110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa858d110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.028] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa858d110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa858d110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa858d110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.028] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.028] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.028] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.029] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sr", cAlternateFileName="")) returned 1 [0040.029] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.029] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.029] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.029] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0040.029] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.029] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0040.029] GetLastError () returned 0xea [0040.029] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.030] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0d54*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0d54*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.032] SetEndOfFile (hFile=0x10c) returned 1 [0040.032] CloseHandle (hObject=0x10c) returned 1 [0040.032] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.032] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.032] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa858d110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa858d110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.032] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa858d110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa858d110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.033] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa858d110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa858d110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa858d110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.033] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.033] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.033] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.033] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="th", cAlternateFileName="")) returned 1 [0040.033] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.033] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.033] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.033] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.033] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.033] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0040.033] GetLastError () returned 0xea [0040.033] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.034] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.034] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0a8c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0a8c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.036] SetEndOfFile (hFile=0x10c) returned 1 [0040.036] CloseHandle (hObject=0x10c) returned 1 [0040.036] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.036] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa858d110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa858d110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.036] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa858d110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa858d110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.036] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa858d110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa858d110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa858d110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.036] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.036] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.036] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.037] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="tr", cAlternateFileName="")) returned 1 [0040.037] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.037] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.037] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.037] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0040.037] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.037] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0040.037] GetLastError () returned 0xea [0040.037] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.038] WriteFile (in: hFile=0x10c, lpBuffer=0x33e14e4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e14e4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.039] SetEndOfFile (hFile=0x10c) returned 1 [0040.040] CloseHandle (hObject=0x10c) returned 1 [0040.040] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.040] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.040] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa858d110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa858d110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.040] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa858d110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa858d110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.040] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa858d110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa858d110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85b3270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.040] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.040] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.040] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.040] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="uk", cAlternateFileName="")) returned 1 [0040.040] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.041] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.041] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.041] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.041] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.041] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0040.041] GetLastError () returned 0xea [0040.041] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.041] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.042] WriteFile (in: hFile=0x10c, lpBuffer=0x33e19ac*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e19ac*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.043] SetEndOfFile (hFile=0x10c) returned 1 [0040.043] CloseHandle (hObject=0x10c) returned 1 [0040.043] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.043] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.043] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85b3270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85b3270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.044] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85b3270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85b3270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.044] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa85b3270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa85b3270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85b3270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.044] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.044] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.044] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.044] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="vi", cAlternateFileName="")) returned 1 [0040.044] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.044] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.045] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.045] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0040.045] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.045] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a3c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1a3c, pdwDataLen=0x18e0d0) returned 0 [0040.045] GetLastError () returned 0xea [0040.045] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1a3c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1a3c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.045] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.047] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d18*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d18*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.048] SetEndOfFile (hFile=0x10c) returned 1 [0040.048] CloseHandle (hObject=0x10c) returned 1 [0040.049] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.049] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.049] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85b3270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85b3270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.049] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85b3270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85b3270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.049] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa85b3270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa85b3270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85b3270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.049] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.049] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.049] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.049] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0040.049] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.050] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.050] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.050] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.050] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.050] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0040.050] GetLastError () returned 0xea [0040.050] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.050] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.051] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2fa0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2fa0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.052] SetEndOfFile (hFile=0x10c) returned 1 [0040.052] CloseHandle (hObject=0x10c) returned 1 [0040.053] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.053] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.053] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85b3270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85b3270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.053] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85b3270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85b3270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.053] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa85b3270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa85b3270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85b3270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.053] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.053] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.053] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.053] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0040.053] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.054] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.054] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.054] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9180) returned 1 [0040.054] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.054] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e070c, pdwDataLen=0x18e0d0) returned 0 [0040.054] GetLastError () returned 0xea [0040.054] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e070c*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.054] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.055] WriteFile (in: hFile=0x10c, lpBuffer=0x33e0ce0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e0ce0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.056] SetEndOfFile (hFile=0x10c) returned 1 [0040.056] CloseHandle (hObject=0x10c) returned 1 [0040.056] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.057] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.057] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.057] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.057] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa85d93d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.057] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.057] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.057] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.057] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0040.057] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0040.057] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0040.057] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0040.058] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0040.058] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.058] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c9180) returned 1 [0040.058] CryptDestroyHash (hHash=0x5c9200) returned 1 [0040.058] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17dc*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f17dc, pdwDataLen=0x18e338) returned 0 [0040.058] GetLastError () returned 0xea [0040.058] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17dc*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f17dc*, pdwDataLen=0x18e334*=0x260) returned 1 [0040.058] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.059] WriteFile (in: hFile=0x100, lpBuffer=0x33e11fc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33e11fc*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0040.060] SetEndOfFile (hFile=0x100) returned 1 [0040.060] CloseHandle (hObject=0x100) returned 1 [0040.060] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.060] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.060] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.060] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.060] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa85d93d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.061] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0040.061] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ae0b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86adfb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xdd12c400, ftLastWriteTime.dwHighDateTime=0x1d0683e, nFileSizeHigh=0x0, nFileSizeLow=0x2686, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0040.061] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.061] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ae0b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ae0b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0040.061] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.061] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84364b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.061] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa84364b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa84364b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa84364b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.061] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.061] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0040.061] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.061] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.061] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.062] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c91c0) returned 1 [0040.062] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.062] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e808) returned 0 [0040.062] GetLastError () returned 0xea [0040.062] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.062] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.062] WriteFile (in: hFile=0x104, lpBuffer=0x33e19bc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33e19bc*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.064] SetEndOfFile (hFile=0x104) returned 1 [0040.064] CloseHandle (hObject=0x104) returned 1 [0040.064] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.064] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.064] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.064] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.064] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5817.313.0.5_0", cAlternateFileName="581731~1.5_0")) returned 1 [0040.064] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.065] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.065] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.065] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9180) returned 1 [0040.065] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.065] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d88*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d88, pdwDataLen=0x18e5a0) returned 0 [0040.065] GetLastError () returned 0xea [0040.065] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d88*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d88*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.065] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.066] WriteFile (in: hFile=0xfc, lpBuffer=0x33f2e48*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33f2e48*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.067] SetEndOfFile (hFile=0xfc) returned 1 [0040.067] CloseHandle (hObject=0xfc) returned 1 [0040.067] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.067] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.067] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.068] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.068] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0bf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="angular.js", cAlternateFileName="")) returned 1 [0040.068] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83641800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83643f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xa89c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="background_script.js", cAlternateFileName="BACKGR~1.JS")) returned 1 [0040.068] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83646620, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83648d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x181aa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cast_game_sender.js", cAlternateFileName="CAST_G~1.JS")) returned 1 [0040.068] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8364db50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8364db50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cast_route_details.html", cAlternateFileName="CAST_R~1.HTM")) returned 1 [0040.068] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83652970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83657790, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3a258, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cast_route_details.js", cAlternateFileName="CAST_R~1.JS")) returned 1 [0040.068] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8365ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836613d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xce17, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cast_sender.js", cAlternateFileName="CAST_S~1.JS")) returned 1 [0040.068] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa2656110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2656110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cast_setup", cAlternateFileName="CAST_S~1")) returned 1 [0040.068] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0040.068] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0040.068] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.068] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c9200) returned 1 [0040.068] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.069] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2e9c*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f2e9c, pdwDataLen=0x18e338) returned 0 [0040.069] GetLastError () returned 0xea [0040.069] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2e9c*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f2e9c*, pdwDataLen=0x18e334*=0x260) returned 1 [0040.069] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.070] WriteFile (in: hFile=0x100, lpBuffer=0x33e1588*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33e1588*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0040.071] SetEndOfFile (hFile=0x100) returned 1 [0040.071] CloseHandle (hObject=0x100) returned 1 [0040.071] CryptDestroyKey (hKey=0x5c9200) returned 1 [0040.071] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.071] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0040.071] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.071] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836661f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836661f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x1a1d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cast_app.css", cAlternateFileName="")) returned 1 [0040.071] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366b010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366d720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x221da, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cast_app.js", cAlternateFileName="")) returned 1 [0040.071] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8366fe30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8366fe30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cast_app_redirect.js", cAlternateFileName="CAST_A~1.JS")) returned 1 [0040.071] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2656110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2656110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2656110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1bef, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="chromecast_logo_grey.png.crypt", cAlternateFileName="CHROME~1.CRY")) returned 1 [0040.071] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83679a70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83679a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="devices.html", cAlternateFileName="DEVICE~1.HTM")) returned 1 [0040.071] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa85d93d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85ff530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.071] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8367c180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8367c180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0040.072] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83685dc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83685dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="offers.html", cAlternateFileName="OFFERS~1.HTM")) returned 1 [0040.072] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 1 [0040.072] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836884d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368abe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="setup.html", cAlternateFileName="SETUP~1.HTM")) returned 0 [0040.072] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0040.072] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="cloud_route_details", cAlternateFileName="CLOUD_~1")) returned 1 [0040.072] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0040.072] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0040.072] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.072] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c90c0) returned 1 [0040.072] CryptDestroyHash (hHash=0x5c9200) returned 1 [0040.072] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2e84*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f2e84, pdwDataLen=0x18e338) returned 0 [0040.072] GetLastError () returned 0xea [0040.072] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2e84*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f2e84*, pdwDataLen=0x18e334*=0x260) returned 1 [0040.073] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.075] WriteFile (in: hFile=0x100, lpBuffer=0x33e2084*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33e2084*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0040.076] SetEndOfFile (hFile=0x100) returned 1 [0040.076] CloseHandle (hObject=0x100) returned 1 [0040.077] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.077] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.077] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85ff530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85ff530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.077] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85ff530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85ff530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa85ff530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa85ff530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85ff530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8368fa00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8368fa00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x174c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="view.html", cAlternateFileName="VIEW~1.HTM")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="view.js", cAlternateFileName="")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83694820, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x945, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="view.js", cAlternateFileName="")) returned 0 [0040.077] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83696f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83699640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="common.js", cAlternateFileName="")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8369bd50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8369bd50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="feedback.css", cAlternateFileName="")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a0b70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a0b70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x38a8, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="feedback.html", cAlternateFileName="FEEDBA~1.HTM")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a5990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a5990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="feedback_script.js", cAlternateFileName="FEEDBA~1.JS")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa85d93d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836af5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8395fd70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b1ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b43f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x46039, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="material_css_min.css", cAlternateFileName="MATERI~1.CSS")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b6b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b9210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x7c33, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="mirroring_cast_streaming.js", cAlternateFileName="MIRROR~1.JS")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836c2e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836c5560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2adeb, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="mirroring_common.js", cAlternateFileName="MIRROR~2.JS")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836ca380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836cf1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x794cf, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="mirroring_hangouts.js", cAlternateFileName="MIRROR~3.JS")) returned 1 [0040.077] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836d3fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836d66d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x941, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="mirroring_webrtc.js", cAlternateFileName="MIRROR~4.JS")) returned 1 [0040.078] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_locales", cAlternateFileName="")) returned 1 [0040.078] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0040.078] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0040.078] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.078] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c9200) returned 1 [0040.078] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.078] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d80, pdwDataLen=0x18e338) returned 0 [0040.078] GetLastError () returned 0xea [0040.078] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d80*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d80*, pdwDataLen=0x18e334*=0x260) returned 1 [0040.079] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.080] WriteFile (in: hFile=0x100, lpBuffer=0x33f2798*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33f2798*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0040.081] SetEndOfFile (hFile=0x100) returned 1 [0040.081] CloseHandle (hObject=0x100) returned 1 [0040.081] CryptDestroyKey (hKey=0x5c9200) returned 1 [0040.081] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.081] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85ff530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85ff530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0040.082] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85ff530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85ff530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.082] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="am", cAlternateFileName="")) returned 1 [0040.082] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.082] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.082] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.082] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.082] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.082] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0040.082] GetLastError () returned 0xea [0040.082] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.083] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.084] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1d60*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1d60*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.085] SetEndOfFile (hFile=0x10c) returned 1 [0040.085] CloseHandle (hObject=0x10c) returned 1 [0040.085] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.085] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.085] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85ff530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85ff530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.085] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa85ff530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85ff530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.085] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa85ff530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa85ff530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85ff530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.085] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.085] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.085] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.086] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ar", cAlternateFileName="")) returned 1 [0040.086] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.086] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.086] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.086] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.086] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.086] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d88*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f1d88, pdwDataLen=0x18e0d0) returned 0 [0040.086] GetLastError () returned 0xea [0040.086] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f1d88*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f1d88*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.087] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.087] WriteFile (in: hFile=0x10c, lpBuffer=0x33f27a0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f27a0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.088] SetEndOfFile (hFile=0x10c) returned 1 [0040.089] CloseHandle (hObject=0x10c) returned 1 [0040.089] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.089] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.089] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8625690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8625690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.089] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8625690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8625690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.089] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8625690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8625690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8625690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.089] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.089] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.089] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.089] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="bg", cAlternateFileName="")) returned 1 [0040.089] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.090] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.090] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.090] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.090] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.090] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2018*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2018, pdwDataLen=0x18e0d0) returned 0 [0040.090] GetLastError () returned 0xea [0040.090] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2018*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2018*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.090] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.091] WriteFile (in: hFile=0x10c, lpBuffer=0x33f25ec*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f25ec*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.092] SetEndOfFile (hFile=0x10c) returned 1 [0040.092] CloseHandle (hObject=0x10c) returned 1 [0040.092] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.092] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.092] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8625690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8625690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.093] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8625690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8625690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.093] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8625690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8625690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8625690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.093] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.093] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.093] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.093] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="bn", cAlternateFileName="")) returned 1 [0040.093] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.093] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.093] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.094] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.094] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.094] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ffc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ffc, pdwDataLen=0x18e0d0) returned 0 [0040.094] GetLastError () returned 0xea [0040.094] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ffc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ffc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.095] WriteFile (in: hFile=0x10c, lpBuffer=0x33f28f4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f28f4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.096] SetEndOfFile (hFile=0x10c) returned 1 [0040.096] CloseHandle (hObject=0x10c) returned 1 [0040.096] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.096] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8625690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8625690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.096] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8625690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8625690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.096] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8625690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8625690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8625690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.096] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.096] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.096] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.096] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ca", cAlternateFileName="")) returned 1 [0040.097] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.097] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.097] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.097] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.097] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.097] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1fec*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1fec, pdwDataLen=0x18e0d0) returned 0 [0040.097] GetLastError () returned 0xea [0040.097] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1fec*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1fec*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.098] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.098] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2c50*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2c50*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.099] SetEndOfFile (hFile=0x10c) returned 1 [0040.099] CloseHandle (hObject=0x10c) returned 1 [0040.100] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.100] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.100] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8625690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8625690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.100] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8625690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8625690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.100] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8625690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8625690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8625690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.100] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.100] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.100] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.100] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="cs", cAlternateFileName="")) returned 1 [0040.100] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.101] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.101] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.101] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.101] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.101] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c78*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2c78, pdwDataLen=0x18e0d0) returned 0 [0040.101] GetLastError () returned 0xea [0040.101] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2c78*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2c78*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.101] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.102] WriteFile (in: hFile=0x10c, lpBuffer=0x33e209c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e209c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.103] SetEndOfFile (hFile=0x10c) returned 1 [0040.103] CloseHandle (hObject=0x10c) returned 1 [0040.103] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.103] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.103] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa864b7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa864b7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.104] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa864b7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa864b7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.104] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa864b7f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa864b7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa864b7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.104] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.104] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.104] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.104] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="da", cAlternateFileName="")) returned 1 [0040.104] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.104] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.104] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.104] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.104] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.104] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22b8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f22b8, pdwDataLen=0x18e0d0) returned 0 [0040.105] GetLastError () returned 0xea [0040.105] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f22b8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f22b8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.105] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.108] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03f4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03f4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.109] SetEndOfFile (hFile=0x10c) returned 1 [0040.109] CloseHandle (hObject=0x10c) returned 1 [0040.109] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.109] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.109] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa864b7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa864b7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.110] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa864b7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa864b7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.110] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa864b7f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa864b7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa864b7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.110] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.110] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.110] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.110] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="de", cAlternateFileName="")) returned 1 [0040.110] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.110] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.110] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.110] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.111] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.111] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0040.111] GetLastError () returned 0xea [0040.111] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.111] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.112] WriteFile (in: hFile=0x10c, lpBuffer=0x33f21c4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f21c4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.113] SetEndOfFile (hFile=0x10c) returned 1 [0040.113] CloseHandle (hObject=0x10c) returned 1 [0040.113] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.113] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.113] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa864b7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa864b7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.113] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa864b7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa864b7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.113] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa864b7f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa864b7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa864b7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.113] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.113] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.113] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.113] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="el", cAlternateFileName="")) returned 1 [0040.114] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.114] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.114] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.114] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.114] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.114] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ac, pdwDataLen=0x18e0d0) returned 0 [0040.114] GetLastError () returned 0xea [0040.114] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.115] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.115] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1d60*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1d60*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.117] SetEndOfFile (hFile=0x10c) returned 1 [0040.117] CloseHandle (hObject=0x10c) returned 1 [0040.117] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.117] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa864b7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa864b7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.117] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa864b7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa864b7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.117] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa864b7f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa864b7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8671950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.117] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.117] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.117] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.117] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="en", cAlternateFileName="")) returned 1 [0040.118] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.118] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.118] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.118] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.118] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.118] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15a8*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e15a8, pdwDataLen=0x18e0d0) returned 0 [0040.118] GetLastError () returned 0xea [0040.118] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15a8*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e15a8*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.119] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.120] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2818*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2818*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.121] SetEndOfFile (hFile=0x10c) returned 1 [0040.121] CloseHandle (hObject=0x10c) returned 1 [0040.121] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.121] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8671950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8671950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.121] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8671950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8671950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.121] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8671950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8671950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8671950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.121] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.121] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.121] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.121] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="es", cAlternateFileName="")) returned 1 [0040.121] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.122] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.122] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.122] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.122] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.122] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1598*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1598, pdwDataLen=0x18e0d0) returned 0 [0040.122] GetLastError () returned 0xea [0040.122] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1598*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1598*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.122] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.123] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1e44*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1e44*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.124] SetEndOfFile (hFile=0x10c) returned 1 [0040.124] CloseHandle (hObject=0x10c) returned 1 [0040.125] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.125] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.125] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8671950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8671950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.125] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8671950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8671950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.125] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8671950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8671950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8671950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.125] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.125] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.125] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.125] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="et", cAlternateFileName="")) returned 1 [0040.125] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.126] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.126] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.126] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.126] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.126] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1828*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1828, pdwDataLen=0x18e0d0) returned 0 [0040.126] GetLastError () returned 0xea [0040.126] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1828*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1828*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.126] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.127] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2924*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2924*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.128] SetEndOfFile (hFile=0x10c) returned 1 [0040.128] CloseHandle (hObject=0x10c) returned 1 [0040.128] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.128] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.128] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8671950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8671950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.129] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8671950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8671950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.129] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8671950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8671950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8671950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.129] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.129] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.129] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.129] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fa", cAlternateFileName="")) returned 1 [0040.129] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.129] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.130] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.130] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.130] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.130] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1598*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1598, pdwDataLen=0x18e0d0) returned 0 [0040.130] GetLastError () returned 0xea [0040.130] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1598*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1598*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.130] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.131] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1800*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1800*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.132] SetEndOfFile (hFile=0x10c) returned 1 [0040.132] CloseHandle (hObject=0x10c) returned 1 [0040.132] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.132] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8671950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8671950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.132] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8671950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8671950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.132] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8671950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8671950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8697ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.132] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.132] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.132] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.132] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fi", cAlternateFileName="")) returned 1 [0040.132] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.133] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.133] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.133] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.133] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.133] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1828*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1828, pdwDataLen=0x18e0d0) returned 0 [0040.133] GetLastError () returned 0xea [0040.133] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1828*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1828*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.134] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.134] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2ddc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2ddc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.136] SetEndOfFile (hFile=0x10c) returned 1 [0040.136] CloseHandle (hObject=0x10c) returned 1 [0040.136] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.136] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.136] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8697ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8697ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.136] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8697ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8697ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.136] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8697ab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8697ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8697ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.136] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.136] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.137] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.137] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fil", cAlternateFileName="")) returned 1 [0040.137] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.137] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.137] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.137] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.137] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.137] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1598*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1598, pdwDataLen=0x18e0d0) returned 0 [0040.137] GetLastError () returned 0xea [0040.137] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1598*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1598*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.138] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.138] WriteFile (in: hFile=0x10c, lpBuffer=0x33f03c4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f03c4*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.139] SetEndOfFile (hFile=0x10c) returned 1 [0040.139] CloseHandle (hObject=0x10c) returned 1 [0040.140] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.140] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.140] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8697ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8697ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.140] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8697ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8697ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.140] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8697ab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8697ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8697ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.140] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.140] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.140] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.140] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="fr", cAlternateFileName="")) returned 1 [0040.140] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.141] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.141] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.141] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.141] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.141] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2990*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f2990, pdwDataLen=0x18e0d0) returned 0 [0040.141] GetLastError () returned 0xea [0040.141] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f2990*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f2990*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.141] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.142] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1e54*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1e54*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.143] SetEndOfFile (hFile=0x10c) returned 1 [0040.143] CloseHandle (hObject=0x10c) returned 1 [0040.143] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.143] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.143] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8697ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8697ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.144] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8697ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8697ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.144] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8697ab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8697ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8697ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.144] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.144] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.144] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.144] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="gu", cAlternateFileName="")) returned 1 [0040.144] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.145] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.145] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.145] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.145] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.145] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ec*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f17ec, pdwDataLen=0x18e0d0) returned 0 [0040.145] GetLastError () returned 0xea [0040.145] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f17ec*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f17ec*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.145] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.146] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1da0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1da0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.147] SetEndOfFile (hFile=0x10c) returned 1 [0040.147] CloseHandle (hObject=0x10c) returned 1 [0040.147] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.147] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.147] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8697ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8697ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.148] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8697ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8697ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.148] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8697ab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8697ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8697ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.148] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.148] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.148] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.148] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hi", cAlternateFileName="")) returned 1 [0040.148] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.148] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.148] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.148] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.148] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.149] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1f58*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1f58, pdwDataLen=0x18e0d0) returned 0 [0040.149] GetLastError () returned 0xea [0040.149] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1f58*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1f58*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.149] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.150] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2570*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2570*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.151] SetEndOfFile (hFile=0x10c) returned 1 [0040.151] CloseHandle (hObject=0x10c) returned 1 [0040.151] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.151] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.151] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86bdc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86bdc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.151] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86bdc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86bdc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.151] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa86bdc10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa86bdc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86bdc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.151] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.151] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.151] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.151] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa85ff530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa85ff530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85ff530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.151] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hr", cAlternateFileName="")) returned 1 [0040.152] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.152] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.152] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.152] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.152] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.152] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1f48*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1f48, pdwDataLen=0x18e0d0) returned 0 [0040.152] GetLastError () returned 0xea [0040.152] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1f48*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1f48*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.153] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2a70*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2a70*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.155] SetEndOfFile (hFile=0x10c) returned 1 [0040.155] CloseHandle (hObject=0x10c) returned 1 [0040.155] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.155] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.155] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86bdc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86bdc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.155] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86bdc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86bdc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.155] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa86bdc10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa86bdc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86bdc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.155] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.155] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.155] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.156] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="hu", cAlternateFileName="")) returned 1 [0040.156] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.156] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.156] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.156] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.156] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.156] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03bc*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03bc, pdwDataLen=0x18e0d0) returned 0 [0040.156] GetLastError () returned 0xea [0040.156] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03bc*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03bc*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.157] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.157] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2ddc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2ddc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.158] SetEndOfFile (hFile=0x10c) returned 1 [0040.158] CloseHandle (hObject=0x10c) returned 1 [0040.159] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.159] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86bdc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86bdc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.159] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86bdc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86bdc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.159] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa86bdc10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa86bdc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86bdc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.159] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.159] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.159] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.159] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="id", cAlternateFileName="")) returned 1 [0040.159] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.160] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.160] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.160] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.160] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.160] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.160] GetLastError () returned 0xea [0040.160] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.160] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.161] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1fe8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1fe8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.162] SetEndOfFile (hFile=0x10c) returned 1 [0040.162] CloseHandle (hObject=0x10c) returned 1 [0040.162] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.162] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.162] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86bdc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86bdc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.163] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86bdc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86bdc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.163] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa86bdc10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa86bdc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86bdc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.163] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.163] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.163] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.163] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="it", cAlternateFileName="")) returned 1 [0040.163] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.163] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.163] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.164] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.164] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.164] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.164] GetLastError () returned 0xea [0040.164] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.164] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.165] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2a60*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2a60*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.166] SetEndOfFile (hFile=0x10c) returned 1 [0040.166] CloseHandle (hObject=0x10c) returned 1 [0040.166] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.166] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.166] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86e3d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86e3d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.167] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86e3d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86e3d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.167] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa86e3d70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa86e3d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86e3d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.167] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.167] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.167] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.167] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="iw", cAlternateFileName="")) returned 1 [0040.167] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.167] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.167] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.167] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.167] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.167] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.167] GetLastError () returned 0xea [0040.167] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.168] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.168] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2dbc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2dbc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.170] SetEndOfFile (hFile=0x10c) returned 1 [0040.170] CloseHandle (hObject=0x10c) returned 1 [0040.170] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.170] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.170] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86e3d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86e3d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.170] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86e3d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86e3d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.170] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa86e3d70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa86e3d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86e3d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.170] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.170] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.170] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.170] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ja", cAlternateFileName="")) returned 1 [0040.170] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.171] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.171] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.171] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.171] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.171] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.171] GetLastError () returned 0xea [0040.171] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.171] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.172] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2ddc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2ddc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.173] SetEndOfFile (hFile=0x10c) returned 1 [0040.173] CloseHandle (hObject=0x10c) returned 1 [0040.174] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.174] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.174] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86e3d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86e3d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.174] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86e3d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86e3d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.174] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa86e3d70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa86e3d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86e3d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.174] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.174] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.174] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.174] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="kn", cAlternateFileName="")) returned 1 [0040.174] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.175] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.175] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.175] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.175] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.175] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.175] GetLastError () returned 0xea [0040.175] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.175] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.176] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2a60*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2a60*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.177] SetEndOfFile (hFile=0x10c) returned 1 [0040.177] CloseHandle (hObject=0x10c) returned 1 [0040.177] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.177] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.177] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86e3d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86e3d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.177] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa86e3d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86e3d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.177] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa86e3d70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa86e3d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa86e3d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.177] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.177] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.178] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.178] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ko", cAlternateFileName="")) returned 1 [0040.178] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.178] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.178] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.178] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.178] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.178] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.178] GetLastError () returned 0xea [0040.178] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.179] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.180] WriteFile (in: hFile=0x10c, lpBuffer=0x33e209c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e209c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.181] SetEndOfFile (hFile=0x10c) returned 1 [0040.181] CloseHandle (hObject=0x10c) returned 1 [0040.181] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.181] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.181] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8709ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8709ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.182] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8709ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8709ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.182] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8709ed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8709ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8709ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.182] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.182] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.182] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.182] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d5bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834d5bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lt", cAlternateFileName="")) returned 1 [0040.182] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.182] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.182] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.182] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.182] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.182] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.182] GetLastError () returned 0xea [0040.182] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.183] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.183] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.184] SetEndOfFile (hFile=0x10c) returned 1 [0040.185] CloseHandle (hObject=0x10c) returned 1 [0040.185] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.185] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.185] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8709ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8709ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.185] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834d34a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8709ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8709ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.185] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8709ed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8709ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8709ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.185] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.185] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834d5bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d82c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x416b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.185] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.185] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834dd0e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834dd0e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="lv", cAlternateFileName="")) returned 1 [0040.185] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.186] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.186] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.186] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.186] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.186] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.186] GetLastError () returned 0xea [0040.186] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.186] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.187] WriteFile (in: hFile=0x10c, lpBuffer=0x33e209c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e209c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.188] SetEndOfFile (hFile=0x10c) returned 1 [0040.188] CloseHandle (hObject=0x10c) returned 1 [0040.189] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.189] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.189] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8709ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8709ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.189] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834da9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8709ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8709ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.189] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8709ed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8709ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8709ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.189] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.189] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834dd0e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834df7f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x41bf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.189] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.189] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ebb40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ml", cAlternateFileName="")) returned 1 [0040.189] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.190] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.190] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.190] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.190] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.190] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.190] GetLastError () returned 0xea [0040.190] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.190] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.191] WriteFile (in: hFile=0x10c, lpBuffer=0x33e20ac*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e20ac*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.192] SetEndOfFile (hFile=0x10c) returned 1 [0040.192] CloseHandle (hObject=0x10c) returned 1 [0040.193] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.193] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.193] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8709ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8709ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.193] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834e9430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8709ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8709ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.193] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8709ed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8709ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8709ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.193] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.193] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ebb40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ebb40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x583f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.193] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.193] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834f3070, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="mr", cAlternateFileName="")) returned 1 [0040.193] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.194] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.194] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.194] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.194] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.194] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.194] GetLastError () returned 0xea [0040.194] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.194] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.195] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d60*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d60*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.196] SetEndOfFile (hFile=0x10c) returned 1 [0040.196] CloseHandle (hObject=0x10c) returned 1 [0040.197] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.197] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.197] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834f0960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8730030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834f3070, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834f3070, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398bc90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5224, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.197] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.197] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ff3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ms", cAlternateFileName="")) returned 1 [0040.197] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.198] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.198] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.198] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.198] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.198] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.198] GetLastError () returned 0xea [0040.198] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.198] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.199] WriteFile (in: hFile=0x10c, lpBuffer=0x33e1d70*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e1d70*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.200] SetEndOfFile (hFile=0x10c) returned 1 [0040.200] CloseHandle (hObject=0x10c) returned 1 [0040.200] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.200] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.200] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834fccb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.201] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8730030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.201] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.201] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ff3c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ff3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f8b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.201] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.201] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835068f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="nb", cAlternateFileName="")) returned 1 [0040.201] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.201] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.201] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.201] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.201] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.201] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.201] GetLastError () returned 0xea [0040.201] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.202] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.202] WriteFile (in: hFile=0x10c, lpBuffer=0x33f1de8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f1de8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.203] SetEndOfFile (hFile=0x10c) returned 1 [0040.204] CloseHandle (hObject=0x10c) returned 1 [0040.204] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.204] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.204] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.204] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835041e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.204] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8730030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.204] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.204] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835068f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835068f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ebc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.204] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.204] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8357bbf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="nl", cAlternateFileName="")) returned 1 [0040.204] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.205] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.205] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.205] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.205] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.205] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.205] GetLastError () returned 0xea [0040.205] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.205] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.206] WriteFile (in: hFile=0x10c, lpBuffer=0x33f22f0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f22f0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.207] SetEndOfFile (hFile=0x10c) returned 1 [0040.207] CloseHandle (hObject=0x10c) returned 1 [0040.207] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.207] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.207] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.208] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835794e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.208] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8730030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.208] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.208] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8357bbf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8357bbf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f45, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.208] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.208] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83583120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pl", cAlternateFileName="")) returned 1 [0040.208] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.208] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.208] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.209] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.209] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.209] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.209] GetLastError () returned 0xea [0040.209] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.209] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.210] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2310*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2310*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.211] SetEndOfFile (hFile=0x10c) returned 1 [0040.211] CloseHandle (hObject=0x10c) returned 1 [0040.211] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.211] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.211] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.211] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83580a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8730030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.212] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8730030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8730030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8756190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.212] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.212] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83583120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83583120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8398e3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fd7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.212] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.212] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359b7c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8359b7c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt", cAlternateFileName="")) returned 1 [0040.212] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.212] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.212] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.212] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.212] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.212] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.212] GetLastError () returned 0xea [0040.212] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.213] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.213] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.217] SetEndOfFile (hFile=0x10c) returned 1 [0040.217] CloseHandle (hObject=0x10c) returned 1 [0040.217] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.217] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8756190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8756190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.217] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8358f470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8756190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8756190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.217] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8756190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8756190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8756190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.217] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.217] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8359b7c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8359ded0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.217] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.218] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a05e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0040.218] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.218] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.218] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.218] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.218] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.218] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.218] GetLastError () returned 0xea [0040.218] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.219] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.219] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2e4c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2e4c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.220] SetEndOfFile (hFile=0x10c) returned 1 [0040.220] CloseHandle (hObject=0x10c) returned 1 [0040.221] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.221] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.221] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8756190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8756190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.221] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835969a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8756190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8756190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.221] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8756190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8756190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8756190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.221] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.221] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a05e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a05e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.221] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.221] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835a5400, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0040.221] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.222] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.222] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.222] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.222] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.222] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.222] GetLastError () returned 0xea [0040.222] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.222] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.223] WriteFile (in: hFile=0x10c, lpBuffer=0x33e209c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e209c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.224] SetEndOfFile (hFile=0x10c) returned 1 [0040.224] CloseHandle (hObject=0x10c) returned 1 [0040.224] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.224] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.224] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8756190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8756190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.225] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835990b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8756190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8756190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.225] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8756190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8756190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8756190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.225] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.225] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835a5400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835a5400, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3fdc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.225] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.225] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b1750, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b1750, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ro", cAlternateFileName="")) returned 1 [0040.225] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.226] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.226] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.226] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.226] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.226] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.226] GetLastError () returned 0xea [0040.226] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.226] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.227] WriteFile (in: hFile=0x10c, lpBuffer=0x33f22c0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f22c0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.228] SetEndOfFile (hFile=0x10c) returned 1 [0040.229] CloseHandle (hObject=0x10c) returned 1 [0040.229] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.229] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.229] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa877c2f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa877c2f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.229] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835aa220, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa877c2f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa877c2f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.229] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa877c2f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa877c2f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa877c2f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.229] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.229] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b1750, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b3e60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83990ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40db, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.229] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.229] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835b8c80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835b8c80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ru", cAlternateFileName="")) returned 1 [0040.229] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.230] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.230] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.230] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.230] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.230] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.230] GetLastError () returned 0xea [0040.230] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.230] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.231] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2dcc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2dcc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.232] SetEndOfFile (hFile=0x10c) returned 1 [0040.232] CloseHandle (hObject=0x10c) returned 1 [0040.232] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.232] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.232] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa877c2f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa877c2f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.233] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835b6570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa877c2f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa877c2f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.233] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa877c2f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa877c2f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa877c2f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.233] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.233] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835b8c80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835bb390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x490e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.233] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.233] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c01b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c01b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sk", cAlternateFileName="")) returned 1 [0040.233] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.234] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.234] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.234] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.234] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.234] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.234] GetLastError () returned 0xea [0040.234] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.234] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.238] WriteFile (in: hFile=0x10c, lpBuffer=0x33f263c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f263c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.239] SetEndOfFile (hFile=0x10c) returned 1 [0040.239] CloseHandle (hObject=0x10c) returned 1 [0040.239] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.239] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.239] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa877c2f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa877c2f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.240] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa877c2f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa877c2f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.240] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa877c2f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa877c2f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa877c2f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.240] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.240] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c01b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c28c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40fd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.240] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.240] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835c9df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sl", cAlternateFileName="")) returned 1 [0040.240] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.240] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.240] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.240] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.240] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.240] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.241] GetLastError () returned 0xea [0040.241] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.241] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.242] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2dd0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2dd0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.243] SetEndOfFile (hFile=0x10c) returned 1 [0040.243] CloseHandle (hObject=0x10c) returned 1 [0040.243] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.243] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.243] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.244] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835c4fd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.244] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa87a2450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.244] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.244] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835c9df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835c9df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.244] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.244] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835cec10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835cec10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sr", cAlternateFileName="")) returned 1 [0040.244] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.244] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.244] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.244] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.244] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.244] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.244] GetLastError () returned 0xea [0040.245] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.245] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.246] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2df0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2df0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.247] SetEndOfFile (hFile=0x10c) returned 1 [0040.247] CloseHandle (hObject=0x10c) returned 1 [0040.247] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.247] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.247] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.247] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.247] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa87a2450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.247] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.247] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835cec10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835d1320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839931c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x49c1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.247] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.247] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dd670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sv", cAlternateFileName="")) returned 1 [0040.247] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.248] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.248] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.248] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.248] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.248] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.248] GetLastError () returned 0xea [0040.248] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.249] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.250] SetEndOfFile (hFile=0x10c) returned 1 [0040.250] CloseHandle (hObject=0x10c) returned 1 [0040.251] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.251] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.251] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.251] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835daf60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.251] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa87a2450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.251] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.251] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dd670, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.251] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.251] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835dfd80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="sw", cAlternateFileName="")) returned 1 [0040.251] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.252] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.252] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.252] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.252] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.252] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.252] GetLastError () returned 0xea [0040.252] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.253] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.254] SetEndOfFile (hFile=0x10c) returned 1 [0040.254] CloseHandle (hObject=0x10c) returned 1 [0040.254] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.254] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.254] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.254] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835dd670, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.255] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa87a2450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.255] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.255] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835dfd80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835dfd80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e8b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.255] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.255] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e72b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835e72b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="ta", cAlternateFileName="")) returned 1 [0040.255] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.255] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.255] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.255] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.255] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.255] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.255] GetLastError () returned 0xea [0040.255] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.256] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.256] WriteFile (in: hFile=0x10c, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.258] SetEndOfFile (hFile=0x10c) returned 1 [0040.258] CloseHandle (hObject=0x10c) returned 1 [0040.258] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.258] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.258] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.258] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835e4ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87a2450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.258] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa87a2450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa87a2450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87c85b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.258] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.258] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835e72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835e99c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x563d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.259] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.259] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f0ef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="te", cAlternateFileName="")) returned 1 [0040.259] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.259] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.259] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.259] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.259] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.259] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.259] GetLastError () returned 0xea [0040.259] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.260] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.260] WriteFile (in: hFile=0x10c, lpBuffer=0x33e2024*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e2024*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.264] SetEndOfFile (hFile=0x10c) returned 1 [0040.264] CloseHandle (hObject=0x10c) returned 1 [0040.264] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.264] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.264] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87c85b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87c85b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.264] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835ec0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87c85b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87c85b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.264] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa87c85b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa87c85b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87c85b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.264] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.264] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f0ef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f0ef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839958d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5593, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.265] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.265] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835f8420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835f8420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="th", cAlternateFileName="")) returned 1 [0040.265] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.265] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.265] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.265] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.265] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.265] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.265] GetLastError () returned 0xea [0040.265] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.266] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.266] WriteFile (in: hFile=0x10c, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.267] SetEndOfFile (hFile=0x10c) returned 1 [0040.267] CloseHandle (hObject=0x10c) returned 1 [0040.268] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.268] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.268] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87c85b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87c85b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.268] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835f5d10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87c85b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87c85b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.268] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa87c85b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa87c85b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87c85b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.268] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.268] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835f8420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835fab30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4f64, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.268] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.268] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x835ff950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x835ff950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="tr", cAlternateFileName="")) returned 1 [0040.268] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.269] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.269] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.269] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.269] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.269] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.269] GetLastError () returned 0xea [0040.269] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.269] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.270] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2ddc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2ddc*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.271] SetEndOfFile (hFile=0x10c) returned 1 [0040.271] CloseHandle (hObject=0x10c) returned 1 [0040.271] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.271] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.271] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87c85b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87c85b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.272] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x835fd240, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87c85b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87c85b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.272] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa87c85b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa87c85b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87c85b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.272] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.272] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x835ff950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83602060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.272] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.272] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8360e3b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8360e3b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="uk", cAlternateFileName="")) returned 1 [0040.272] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.273] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.273] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.273] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.273] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.273] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.273] GetLastError () returned 0xea [0040.273] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.273] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.274] WriteFile (in: hFile=0x10c, lpBuffer=0x33e192c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33e192c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.275] SetEndOfFile (hFile=0x10c) returned 1 [0040.275] CloseHandle (hObject=0x10c) returned 1 [0040.275] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.275] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.275] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87ee710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87ee710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.275] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8360bca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87ee710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87ee710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.275] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa87ee710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa87ee710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87ee710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.275] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.275] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8360e3b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83610ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x48f1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.276] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.276] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83617ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="vi", cAlternateFileName="")) returned 1 [0040.276] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.276] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.276] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.276] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.276] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.276] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.276] GetLastError () returned 0xea [0040.276] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.277] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.277] WriteFile (in: hFile=0x10c, lpBuffer=0x33f29a8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f29a8*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.278] SetEndOfFile (hFile=0x10c) returned 1 [0040.279] CloseHandle (hObject=0x10c) returned 1 [0040.279] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.279] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.279] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87ee710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87ee710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.279] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836158e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87ee710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87ee710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.279] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa87ee710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa87ee710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87ee710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.279] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.279] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83617ff0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83617ff0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83997fe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x426b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.279] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.279] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8361f520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh", cAlternateFileName="")) returned 1 [0040.279] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.280] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.280] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.280] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.280] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.280] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.280] GetLastError () returned 0xea [0040.280] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.280] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.281] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2dd0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2dd0*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.282] SetEndOfFile (hFile=0x10c) returned 1 [0040.282] CloseHandle (hObject=0x10c) returned 1 [0040.283] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.283] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.283] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87ee710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87ee710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.283] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8361ce10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87ee710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87ee710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.283] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa87ee710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa87ee710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87ee710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.283] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.283] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8361f520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8361f520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d11, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.283] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.283] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0040.283] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.284] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.284] CryptHashData (hHash=0x5c9080, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.284] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c90c0) returned 1 [0040.284] CryptDestroyHash (hHash=0x5c9080) returned 1 [0040.284] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e0d0) returned 0 [0040.284] GetLastError () returned 0xea [0040.284] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.284] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.285] WriteFile (in: hFile=0x10c, lpBuffer=0x33f2e9c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33f2e9c*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.286] SetEndOfFile (hFile=0x10c) returned 1 [0040.286] CloseHandle (hObject=0x10c) returned 1 [0040.286] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.286] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.286] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87ee710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87ee710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.287] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa87ee710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87ee710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.287] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa87ee710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa87ee710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa87ee710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.287] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0040.287] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8362b870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8399a6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d72, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0040.287] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.287] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83624340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8362b870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8362b870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456e6f, dwReserved1=0x52434e45, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0040.287] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0040.287] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0040.287] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0040.288] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0040.288] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.288] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c90c0) returned 1 [0040.288] CryptDestroyHash (hHash=0x5c9200) returned 1 [0040.288] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e338) returned 0 [0040.288] GetLastError () returned 0xea [0040.288] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e334*=0x260) returned 1 [0040.288] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.291] WriteFile (in: hFile=0x100, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0040.292] SetEndOfFile (hFile=0x100) returned 1 [0040.292] CloseHandle (hObject=0x100) returned 1 [0040.292] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.292] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.292] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8814870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8814870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.292] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8814870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8814870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.292] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x839fe880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7299, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="computed_hashes.json", cAlternateFileName="COMPUT~1.JSO")) returned 1 [0040.292] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8814870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8814870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8814870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.292] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0040.293] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836e0310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 0 [0040.293] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.293] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0040.293] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.293] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa85d93d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x74726265, dwReserved1=0x736a2e63, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.293] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa85d93d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa85d93d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa85d93d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x74726265, dwReserved1=0x736a2e63, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.293] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.293] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8399f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839a6a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839a6a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0 [0040.293] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.293] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80db2b00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Favicons", cAlternateFileName="")) returned 1 [0040.293] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cce2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80cce2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x80e97340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Favicons-journal", cAlternateFileName="FAVICO~1")) returned 1 [0040.293] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81c321d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81c321d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81c58330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b2e9, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Google Profile.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1 [0040.293] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f47590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19000, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="History", cAlternateFileName="")) returned 1 [0040.293] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x824d3190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x824d3190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c3b6860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="History Provider Cache", cAlternateFileName="HISTOR~2")) returned 1 [0040.293] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x802fc800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x802fc800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87f6d6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="History-journal", cAlternateFileName="HISTOR~1")) returned 1 [0040.293] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa738cab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.293] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="JumpListIcons", cAlternateFileName="JUMPLI~2")) returned 1 [0040.293] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.294] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.294] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.294] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c91c0) returned 1 [0040.294] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.294] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18ea70) returned 0 [0040.294] GetLastError () returned 0xea [0040.294] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.294] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.295] WriteFile (in: hFile=0x114, lpBuffer=0x33f2904*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33f2904*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.298] SetEndOfFile (hFile=0x114) returned 1 [0040.298] CloseHandle (hObject=0x114) returned 1 [0040.299] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.299] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.299] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8814870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8814870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.299] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8814870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8814870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.299] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="A058.tmp", cAlternateFileName="")) returned 1 [0040.299] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ec4eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="A059.tmp", cAlternateFileName="")) returned 1 [0040.299] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8814870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8814870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8814870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.299] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8814870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8814870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8814870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.299] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.299] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="JumpListIconsOld", cAlternateFileName="JUMPLI~1")) returned 1 [0040.299] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.300] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.300] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.300] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9140) returned 1 [0040.300] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0040.300] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18ea70) returned 0 [0040.300] GetLastError () returned 0xea [0040.300] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.300] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.301] WriteFile (in: hFile=0x114, lpBuffer=0x33e19a4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33e19a4*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.302] SetEndOfFile (hFile=0x114) returned 1 [0040.302] CloseHandle (hObject=0x114) returned 1 [0040.302] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.302] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.302] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8814870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8814870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.303] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8814870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8814870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.303] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="2B03.tmp", cAlternateFileName="")) returned 1 [0040.303] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85096390, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85096390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="2B04.tmp", cAlternateFileName="")) returned 1 [0040.303] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8814870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8814870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8814870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.303] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8814870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8814870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8814870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.303] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.303] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Local Extension Settings", cAlternateFileName="LOCALE~1")) returned 1 [0040.303] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.304] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.304] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.304] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c91c0) returned 1 [0040.304] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.304] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18ea70) returned 0 [0040.304] GetLastError () returned 0xea [0040.304] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.305] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.305] WriteFile (in: hFile=0x114, lpBuffer=0x33e1d00*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33e1d00*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.306] SetEndOfFile (hFile=0x114) returned 1 [0040.307] CloseHandle (hObject=0x114) returned 1 [0040.307] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.307] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.307] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa883a9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.307] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa883a9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.307] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1 [0040.307] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.308] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.308] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.308] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9180) returned 1 [0040.308] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.308] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e808) returned 0 [0040.308] GetLastError () returned 0xea [0040.308] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.308] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.309] WriteFile (in: hFile=0x104, lpBuffer=0x33e206c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33e206c*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.310] SetEndOfFile (hFile=0x104) returned 1 [0040.311] CloseHandle (hObject=0x104) returned 1 [0040.311] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.311] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.311] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa883a9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.311] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa883a9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.311] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86513570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86513570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86513570, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="000003.log", cAlternateFileName="")) returned 1 [0040.311] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0040.311] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa883a9d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa883a9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.311] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LOCK", cAlternateFileName="")) returned 1 [0040.311] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97256fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LOG", cAlternateFileName="")) returned 1 [0040.311] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0040.311] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8642cdf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8642cdf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8642cdf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0040.311] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.311] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa883a9d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa883a9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x31303030, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.311] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa883a9d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa883a9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x31303030, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.311] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.311] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x90191d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Local Storage", cAlternateFileName="LOCALS~1")) returned 1 [0040.312] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.312] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.312] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.312] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9180) returned 1 [0040.312] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0040.312] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18ea70) returned 0 [0040.312] GetLastError () returned 0xea [0040.312] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.313] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.314] WriteFile (in: hFile=0x114, lpBuffer=0x33f17a4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33f17a4*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.315] SetEndOfFile (hFile=0x114) returned 1 [0040.315] CloseHandle (hObject=0x114) returned 1 [0040.316] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.316] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.316] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa883a9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.316] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83ede170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa883a9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9048b8f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage", cAlternateFileName="CHROME~1.LOC")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90191d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x90191d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x904b1a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal", cAlternateFileName="CHROME~2.LOC")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa883a9d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa883a9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa883a9d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa883a9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.316] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8124f5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Login Data", cAlternateFileName="LOGIND~1")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80fc7e40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80fc7e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Login Data-journal", cAlternateFileName="LOGIND~2")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x825f0410, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Network Action Predictor", cAlternateFileName="NETWOR~1")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82330270, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82330270, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8262ad90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Network Action Predictor-journal", cAlternateFileName="NETWOR~2")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86263d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86263d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86263d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Network Persistent State", cAlternateFileName="NETWOR~3")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x94034050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Origin Bound Certs", cAlternateFileName="ORIGIN~1")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81d16a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81d16a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9405a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Origin Bound Certs-journal", cAlternateFileName="ORIGIN~2")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c43f3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c446910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a9d, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Preferences", cAlternateFileName="PREFER~1")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8dea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8dea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8129b860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="previews_opt_out.db", cAlternateFileName="PREVIE~1.DB")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x804795c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x804795c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x812c19c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="previews_opt_out.db-journal", cAlternateFileName="PREVIE~1.DB-")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x869fc2d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="QuotaManager", cAlternateFileName="QUOTAM~1")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="QuotaManager-journal", cAlternateFileName="QUOTAM~2")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f846500, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f846500, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="README", cAlternateFileName="")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c3f38f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c404a60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8b43, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Secure Preferences", cAlternateFileName="SECURE~1")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82271b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Shortcuts", cAlternateFileName="SHORTC~1")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8218d350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8218d350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x822e3fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Shortcuts-journal", cAlternateFileName="SHORTC~2")) returned 1 [0040.316] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Sync Extension Settings", cAlternateFileName="SYNCEX~1")) returned 1 [0040.317] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.317] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.317] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.317] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c91c0) returned 1 [0040.317] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.317] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18ea70) returned 0 [0040.317] GetLastError () returned 0xea [0040.317] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.318] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.318] WriteFile (in: hFile=0x114, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.319] SetEndOfFile (hFile=0x114) returned 1 [0040.319] CloseHandle (hObject=0x114) returned 1 [0040.320] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.320] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.320] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa883a9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.320] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa883a9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.320] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa883a9d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa883a9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8860b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.320] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0040.320] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.321] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.321] CryptHashData (hHash=0x5c9180, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.321] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9140) returned 1 [0040.321] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.321] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e808) returned 0 [0040.321] GetLastError () returned 0xea [0040.321] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.321] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.322] WriteFile (in: hFile=0x104, lpBuffer=0x33e0efc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33e0efc*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.323] SetEndOfFile (hFile=0x104) returned 1 [0040.323] CloseHandle (hObject=0x104) returned 1 [0040.324] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.324] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.324] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8860b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8860b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.324] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8860b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8860b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.324] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8448d2b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="000003.log", cAlternateFileName="")) returned 1 [0040.324] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CURRENT", cAlternateFileName="")) returned 1 [0040.324] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8860b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8860b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8860b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.324] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LOCK", cAlternateFileName="")) returned 1 [0040.324] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x93935fb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xc3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LOG", cAlternateFileName="")) returned 1 [0040.324] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 1 [0040.324] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84254520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84254520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84254520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MANIFEST-000001", cAlternateFileName="MANIFE~1")) returned 0 [0040.324] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.324] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0 [0040.324] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.324] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d66840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d66840, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8195e7b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Top Sites", cAlternateFileName="TOPSIT~1")) returned 1 [0040.324] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80d8c9a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80d8c9a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81984910, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Top Sites-journal", cAlternateFileName="TOPSIT~2")) returned 1 [0040.324] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c2e920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x88c2e920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x88c2e920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="TransportSecurity", cAlternateFileName="TRANSP~1")) returned 1 [0040.324] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ee3600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x80ee3600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8c6cde50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Visited Links", cAlternateFileName="VISITE~1")) returned 1 [0040.324] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x868593b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x868593b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c656470, dwReserved1=0x6d636270, cFileName="Web Applications", cAlternateFileName="WEBAPP~1")) returned 1 [0040.324] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.325] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.325] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.325] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9140) returned 1 [0040.325] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0040.325] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18ea70) returned 0 [0040.325] GetLastError () returned 0xea [0040.325] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.326] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.326] WriteFile (in: hFile=0x114, lpBuffer=0x33e0aa4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33e0aa4*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.327] SetEndOfFile (hFile=0x114) returned 1 [0040.327] CloseHandle (hObject=0x114) returned 1 [0040.328] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.328] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.328] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8860b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8860b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.328] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8860b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8860b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.328] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8860b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8860b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8860b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.328] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 1 [0040.328] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.329] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.329] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.329] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9180) returned 1 [0040.329] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0040.329] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18e808) returned 0 [0040.329] GetLastError () returned 0xea [0040.329] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.329] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.332] WriteFile (in: hFile=0x104, lpBuffer=0x33e14ec*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33e14ec*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.333] SetEndOfFile (hFile=0x104) returned 1 [0040.333] CloseHandle (hObject=0x104) returned 1 [0040.333] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.333] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.333] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8860b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8860b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.334] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8860b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8860b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.334] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8687f510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8687f510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8687f510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28df6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Google Docs.ico", cAlternateFileName="GOOGLE~1.ICO")) returned 1 [0040.334] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86989eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Google Docs.ico.md5", cAlternateFileName="GOOGLE~1.MD5")) returned 1 [0040.334] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8860b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8860b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8860b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.334] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8860b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8860b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8860b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.334] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.334] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x868593b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86989eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86989eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_crx_aohghmighlieiainnegkcijnfilokake", cAlternateFileName="_CRX_A~1")) returned 0 [0040.334] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.334] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d370c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="Web Data", cAlternateFileName="WEBDAT~1")) returned 1 [0040.334] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d608d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 1 [0040.334] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f86c660, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f86c660, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82d608d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c686769, dwReserved1=0x61696569, cFileName="Web Data-journal", cAlternateFileName="WEBDAT~2")) returned 0 [0040.334] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.334] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616e7275, dwReserved1=0x7474796c, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0040.334] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.335] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.335] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.335] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9140) returned 1 [0040.335] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.335] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18ecd8) returned 0 [0040.335] GetLastError () returned 0xea [0040.335] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.335] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.336] WriteFile (in: hFile=0x108, lpBuffer=0x33f2dcc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33f2dcc*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.337] SetEndOfFile (hFile=0x108) returned 1 [0040.337] CloseHandle (hObject=0x108) returned 1 [0040.338] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.338] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.338] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.338] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.338] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8886c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.338] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8886c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.338] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.338] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0040.338] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.339] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.339] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.339] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0040.339] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.339] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33f03ac, pdwDataLen=0x18ecd8) returned 0 [0040.339] GetLastError () returned 0xea [0040.339] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f03ac*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33f03ac*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.339] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.340] WriteFile (in: hFile=0x108, lpBuffer=0x33e1d28*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33e1d28*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.341] SetEndOfFile (hFile=0x108) returned 1 [0040.341] CloseHandle (hObject=0x108) returned 1 [0040.342] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.342] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.342] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.342] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.342] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8886c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.342] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8886c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.342] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.342] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0040.342] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa738cab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa738cab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa738cab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.342] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0040.342] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0040.342] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.343] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.343] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.343] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9140) returned 1 [0040.343] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.343] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33f004c, pdwDataLen=0x18ecd8) returned 0 [0040.343] GetLastError () returned 0xea [0040.343] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33f004c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.343] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\origintrials\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.344] WriteFile (in: hFile=0x108, lpBuffer=0x33e2094*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33e2094*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.345] SetEndOfFile (hFile=0x108) returned 1 [0040.345] CloseHandle (hObject=0x108) returned 1 [0040.345] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.345] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.345] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.345] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.345] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8886c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.346] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8886c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.346] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.346] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0040.346] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.346] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.346] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.346] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0040.346] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.346] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33f004c, pdwDataLen=0x18ecd8) returned 0 [0040.346] GetLastError () returned 0xea [0040.346] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33f004c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.347] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\pepperflash\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.347] WriteFile (in: hFile=0x108, lpBuffer=0x33f2ddc*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33f2ddc*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.348] SetEndOfFile (hFile=0x108) returned 1 [0040.348] CloseHandle (hObject=0x108) returned 1 [0040.349] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.349] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.349] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.349] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.349] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8886c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.349] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8886c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8886c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8886c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.349] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.349] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="pnacl", cAlternateFileName="")) returned 1 [0040.349] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.350] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.350] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.350] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9140) returned 1 [0040.350] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.350] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33f004c, pdwDataLen=0x18ecd8) returned 0 [0040.350] GetLastError () returned 0xea [0040.350] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33f004c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.350] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\pnacl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.351] WriteFile (in: hFile=0x108, lpBuffer=0x33e18f0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33e18f0*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.352] SetEndOfFile (hFile=0x108) returned 1 [0040.352] CloseHandle (hObject=0x108) returned 1 [0040.352] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.352] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.352] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.353] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.353] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88acdf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.353] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88acdf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.353] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.353] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0040.353] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0040.353] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0040.353] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0040.353] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0040.353] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.354] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.354] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.354] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0040.354] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.354] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33f004c, pdwDataLen=0x18ecd8) returned 0 [0040.354] GetLastError () returned 0xea [0040.354] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33f004c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.354] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.355] WriteFile (in: hFile=0x108, lpBuffer=0x33e1d10*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33e1d10*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.356] SetEndOfFile (hFile=0x108) returned 1 [0040.356] CloseHandle (hObject=0x108) returned 1 [0040.356] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.356] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.356] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.356] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.356] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88acdf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.356] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88acdf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.356] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.356] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0040.356] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.357] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.357] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.357] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9140) returned 1 [0040.357] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.357] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33f004c, pdwDataLen=0x18ecd8) returned 0 [0040.357] GetLastError () returned 0xea [0040.357] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33f004c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.357] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\swreporter\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.358] WriteFile (in: hFile=0x108, lpBuffer=0x33e207c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33e207c*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.359] SetEndOfFile (hFile=0x108) returned 1 [0040.359] CloseHandle (hObject=0x108) returned 1 [0040.360] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.360] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.360] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.360] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.360] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88acdf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.360] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88acdf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.360] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.360] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0040.360] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.361] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.361] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.361] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0040.361] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.361] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33f004c, pdwDataLen=0x18ecd8) returned 0 [0040.361] GetLastError () returned 0xea [0040.361] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33f004c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.361] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.362] WriteFile (in: hFile=0x108, lpBuffer=0x33f2df4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33f2df4*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.363] SetEndOfFile (hFile=0x108) returned 1 [0040.363] CloseHandle (hObject=0x108) returned 1 [0040.363] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.363] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.363] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.363] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.363] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88acdf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.364] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88acdf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.364] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.364] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0040.364] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.364] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0040.364] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.364] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0040.364] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.364] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.364] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.364] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0040.365] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.365] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33f004c, pdwDataLen=0x18f1a8) returned 0 [0040.365] GetLastError () returned 0xea [0040.365] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f004c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33f004c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.365] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\crashreports\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.366] WriteFile (in: hFile=0xe8, lpBuffer=0x33e0dc0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33e0dc0*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.367] SetEndOfFile (hFile=0xe8) returned 1 [0040.367] CloseHandle (hObject=0xe8) returned 1 [0040.368] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.368] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.368] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.368] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88acdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.368] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88acdf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88d2f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.368] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88acdf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88acdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88d2f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.368] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.368] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7366950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.368] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7366950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7366950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7366950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.368] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0040.368] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52434e45, cFileName="History", cAlternateFileName="")) returned 1 [0040.368] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0040.369] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0040.369] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.369] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9100) returned 1 [0040.369] CryptDestroyHash (hHash=0x5c9000) returned 1 [0040.369] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f000c*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33f000c, pdwDataLen=0x18f410) returned 0 [0040.369] GetLastError () returned 0xea [0040.369] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f000c*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33f000c*, pdwDataLen=0x18f40c*=0x260) returned 1 [0040.369] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\history\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0040.371] WriteFile (in: hFile=0xec, lpBuffer=0x33e1d10*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33e1d10*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0040.372] SetEndOfFile (hFile=0xec) returned 1 [0040.373] CloseHandle (hObject=0xec) returned 1 [0040.373] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.373] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.373] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f3a4, ftLastWriteTime.dwHighDateTime=0x18f3a0, nFileSizeHigh=0x18f3e8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x8f\x5c")) returned 0xffffffff [0040.373] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa72ce3d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72ce3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x3, dwReserved1=0x183, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.373] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0x3, dwReserved1=0x183, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0040.373] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0040.373] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0040.374] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0040.374] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.374] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9000) returned 1 [0040.374] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.374] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f02f0*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33f02f0, pdwDataLen=0x18f410) returned 0 [0040.374] GetLastError () returned 0xea [0040.374] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33f02f0*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33f02f0*, pdwDataLen=0x18f40c*=0x260) returned 1 [0040.374] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0040.375] WriteFile (in: hFile=0xec, lpBuffer=0x33e207c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33e207c*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0040.376] SetEndOfFile (hFile=0xec) returned 1 [0040.376] CloseHandle (hObject=0xec) returned 1 [0040.376] CryptDestroyKey (hKey=0x5c9000) returned 1 [0040.376] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.376] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa88d2f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88d2f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0040.377] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa88d2f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88d2f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.377] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0040.377] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.377] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.377] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.377] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0040.377] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.377] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e19e4*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e19e4, pdwDataLen=0x18f1a8) returned 0 [0040.377] GetLastError () returned 0xea [0040.377] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e19e4*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e19e4*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.378] VirtualFree (lpAddress=0x33f0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0040.378] VirtualFree (lpAddress=0x33f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.378] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\credentials\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.379] WriteFile (in: hFile=0xe8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.380] SetEndOfFile (hFile=0xe8) returned 1 [0040.380] CloseHandle (hObject=0xe8) returned 1 [0040.380] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.380] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.381] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa88d2f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88d2f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.381] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa88d2f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88d2f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.381] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88d2f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88d2f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88d2f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.381] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88d2f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88d2f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88d2f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.381] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.381] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0040.381] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.381] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.381] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.381] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0040.382] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.382] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20bc*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e20bc, pdwDataLen=0x18f1a8) returned 0 [0040.382] GetLastError () returned 0xea [0040.382] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20bc*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e20bc*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.382] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\event viewer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.383] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.384] SetEndOfFile (hFile=0xe8) returned 1 [0040.384] CloseHandle (hObject=0xe8) returned 1 [0040.384] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.384] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.384] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xa88f90b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88f90b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.385] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xa88f90b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88f90b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.385] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88f90b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88f90b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88f90b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.385] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88f90b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88f90b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88f90b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.385] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.385] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Feeds", cAlternateFileName="")) returned 1 [0040.385] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.386] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.386] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.386] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0040.386] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.386] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1fc0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1fc0, pdwDataLen=0x18f1a8) returned 0 [0040.386] GetLastError () returned 0xea [0040.386] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1fc0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1fc0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.386] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.387] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.388] SetEndOfFile (hFile=0xe8) returned 1 [0040.388] CloseHandle (hObject=0xe8) returned 1 [0040.388] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.388] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.388] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa88f90b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88f90b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.388] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa88f90b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88f90b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.388] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0040.388] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88f90b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88f90b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88f90b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.388] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1 [0040.388] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.389] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.389] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.389] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0040.389] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.389] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e074c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e074c, pdwDataLen=0x18ef40) returned 0 [0040.389] GetLastError () returned 0xea [0040.389] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e074c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e074c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.389] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.391] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.392] SetEndOfFile (hFile=0xf0) returned 1 [0040.392] CloseHandle (hObject=0xf0) returned 1 [0040.392] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.392] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.392] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa88f90b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88f90b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.393] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa88f90b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88f90b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.393] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88f90b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88f90b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88f90b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.393] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1 [0040.393] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1 [0040.393] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1 [0040.393] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0 [0040.393] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.393] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1 [0040.393] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.393] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.393] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.393] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0040.393] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.394] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e072c, pdwDataLen=0x18ef40) returned 0 [0040.394] GetLastError () returned 0xea [0040.394] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e072c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.394] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.395] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.396] SetEndOfFile (hFile=0xf0) returned 1 [0040.396] CloseHandle (hObject=0xf0) returned 1 [0040.396] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.396] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.396] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa88f90b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88f90b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.396] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa88f90b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88f90b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.396] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88f90b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88f90b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88f90b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.396] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1 [0040.396] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.397] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.397] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.397] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9140) returned 1 [0040.397] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.397] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e072c, pdwDataLen=0x18ecd8) returned 0 [0040.397] GetLastError () returned 0xea [0040.397] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e072c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.398] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.400] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.401] SetEndOfFile (hFile=0x108) returned 1 [0040.401] CloseHandle (hObject=0x108) returned 1 [0040.401] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.401] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.401] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa891f210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.401] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa891f210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.401] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa891f210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa891f210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.401] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52d69eb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Suggested Sites~.feed-ms", cAlternateFileName="SUGGES~1.FEE")) returned 1 [0040.401] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 1 [0040.401] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0 [0040.402] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.402] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 0 [0040.402] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.402] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0 [0040.402] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.402] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa273a950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa273a950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0040.402] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.402] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.402] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.402] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0040.402] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.402] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e072c, pdwDataLen=0x18f1a8) returned 0 [0040.402] GetLastError () returned 0xea [0040.403] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e072c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e072c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.403] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.403] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.404] SetEndOfFile (hFile=0xe8) returned 1 [0040.405] CloseHandle (hObject=0xe8) returned 1 [0040.405] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.405] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.405] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa891f210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.405] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa891f210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.405] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa27147f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27147f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1 [0040.405] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.406] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.406] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.406] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9140) returned 1 [0040.406] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.406] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.406] GetLastError () returned 0xea [0040.406] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.406] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.408] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.409] SetEndOfFile (hFile=0xf0) returned 1 [0040.409] CloseHandle (hObject=0xf0) returned 1 [0040.409] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.409] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.409] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa891f210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.410] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa891f210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.410] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27147f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa27147f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27147f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.410] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0040.410] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa891f210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa891f210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.410] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa891f210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa891f210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.410] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.410] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa27147f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27147f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1 [0040.410] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.410] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.410] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.410] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0040.411] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.411] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.411] GetLastError () returned 0xea [0040.411] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.411] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.413] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.414] SetEndOfFile (hFile=0xf0) returned 1 [0040.414] CloseHandle (hObject=0xf0) returned 1 [0040.414] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.414] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.414] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa891f210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.415] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa891f210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.415] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27147f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa27147f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27147f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.415] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0040.415] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa891f210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8945370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.415] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa891f210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8945370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.415] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.415] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa273a950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa273a950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1 [0040.415] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.415] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.416] CryptHashData (hHash=0x5c8ec0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.416] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9140) returned 1 [0040.416] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.416] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.416] GetLastError () returned 0xea [0040.416] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.416] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.418] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.419] SetEndOfFile (hFile=0xf0) returned 1 [0040.419] CloseHandle (hObject=0xf0) returned 1 [0040.419] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.419] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.420] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8945370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8945370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.420] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8945370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8945370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.420] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa273a950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa273a950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa273a950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.420] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0040.420] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8945370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8945370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8945370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.420] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8945370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8945370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8945370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.420] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.420] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa273a950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa273a950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa273a950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.420] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa891f210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa891f210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa891f210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.420] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="index.dat", cAlternateFileName="")) returned 1 [0040.420] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa273a950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa273a950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1 [0040.420] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.421] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.421] CryptHashData (hHash=0x5c9140, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.421] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0040.421] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.421] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.421] GetLastError () returned 0xea [0040.421] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.421] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.422] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.423] SetEndOfFile (hFile=0xf0) returned 1 [0040.423] CloseHandle (hObject=0xf0) returned 1 [0040.423] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.423] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.423] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8945370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8945370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.423] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8945370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8945370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.423] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa273a950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa273a950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa273a950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.423] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0040.423] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8945370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8945370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8945370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.423] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1 [0040.423] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0 [0040.424] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.424] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa273a950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa273a950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0 [0040.424] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.424] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="FORMS", cAlternateFileName="")) returned 1 [0040.424] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.424] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.424] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.424] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0040.424] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.424] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.424] GetLastError () returned 0xea [0040.424] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.425] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.426] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.427] SetEndOfFile (hFile=0xe8) returned 1 [0040.427] CloseHandle (hObject=0xe8) returned 1 [0040.427] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.427] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.427] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xa8945370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8945370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.427] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xa8945370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8945370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.427] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1 [0040.427] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8945370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8945370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8945370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.427] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8945370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8945370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8945370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.428] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.428] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88d2f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88d2f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88d2f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.428] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IME12", cAlternateFileName="")) returned 1 [0040.428] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.428] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.428] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.429] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0040.429] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.429] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.429] GetLastError () returned 0xea [0040.429] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.429] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\ime12\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.430] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.431] SetEndOfFile (hFile=0xe8) returned 1 [0040.431] CloseHandle (hObject=0xe8) returned 1 [0040.431] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.431] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.431] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.432] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.432] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa896b4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.432] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa896b4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.432] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.432] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0040.432] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.432] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.432] CryptHashData (hHash=0x5c9100, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.432] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0040.433] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.433] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.433] GetLastError () returned 0xea [0040.433] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.433] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp12\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.434] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.435] SetEndOfFile (hFile=0xe8) returned 1 [0040.435] CloseHandle (hObject=0xe8) returned 1 [0040.435] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.435] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.435] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.436] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.436] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa896b4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.436] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa896b4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.436] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.436] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0040.436] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.436] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.436] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.436] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0040.436] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.437] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.437] GetLastError () returned 0xea [0040.437] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.437] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp8_1\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.438] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.439] SetEndOfFile (hFile=0xe8) returned 1 [0040.439] CloseHandle (hObject=0xe8) returned 1 [0040.439] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.439] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.439] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.440] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.440] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa896b4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.440] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa896b4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.440] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.440] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0040.440] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.440] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.441] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.441] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0040.441] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.441] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.441] GetLastError () returned 0xea [0040.441] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.441] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp9_0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.445] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.446] SetEndOfFile (hFile=0xe8) returned 1 [0040.446] CloseHandle (hObject=0xe8) returned 1 [0040.446] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.446] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.446] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.447] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa896b4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.447] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa896b4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8991630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.447] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa896b4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa896b4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8991630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.447] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.447] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa2760ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2760ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0040.447] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.447] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.447] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.447] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0040.447] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.447] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.447] GetLastError () returned 0xea [0040.447] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.448] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.448] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.449] SetEndOfFile (hFile=0xe8) returned 1 [0040.450] CloseHandle (hObject=0xe8) returned 1 [0040.450] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.450] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.450] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8991630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8991630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.450] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8991630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8991630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.450] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="brndlog.bak", cAlternateFileName="")) returned 1 [0040.450] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2760ab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2760ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2760ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="brndlog.txt.crypt", cAlternateFileName="BRNDLO~1.CRY")) returned 1 [0040.450] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0040.450] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.451] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.451] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.451] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9140) returned 1 [0040.451] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.451] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.451] GetLastError () returned 0xea [0040.451] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.451] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.453] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.454] SetEndOfFile (hFile=0xf0) returned 1 [0040.454] CloseHandle (hObject=0xf0) returned 1 [0040.455] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.455] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.455] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa8991630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8991630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.455] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa8991630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8991630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.455] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1 [0040.455] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.456] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.456] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.456] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0040.456] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.456] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.456] GetLastError () returned 0xea [0040.456] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.456] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\3lkbqzj3\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.457] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.458] SetEndOfFile (hFile=0x108) returned 1 [0040.458] CloseHandle (hObject=0x108) returned 1 [0040.458] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.458] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.458] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa8991630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8991630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.458] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa8991630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8991630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.458] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8991630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8991630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8991630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.458] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8991630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8991630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8991630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.458] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.458] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="8NES5H33", cAlternateFileName="")) returned 1 [0040.459] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.459] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.459] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.459] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0040.459] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.459] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.459] GetLastError () returned 0xea [0040.459] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.460] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.460] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.461] SetEndOfFile (hFile=0x108) returned 1 [0040.461] CloseHandle (hObject=0x108) returned 1 [0040.462] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.462] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.462] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.462] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.462] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 1 [0040.462] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89b7790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.462] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89b7790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.462] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.462] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="FKLUIDU0", cAlternateFileName="")) returned 1 [0040.462] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.463] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.463] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.463] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0040.463] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.463] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.463] GetLastError () returned 0xea [0040.463] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.463] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\fkluidu0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.464] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.465] SetEndOfFile (hFile=0x108) returned 1 [0040.465] CloseHandle (hObject=0x108) returned 1 [0040.465] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.466] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.466] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.466] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.466] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89b7790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.466] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89b7790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.466] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.466] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8991630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8991630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8991630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.466] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="index.dat", cAlternateFileName="")) returned 1 [0040.466] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1 [0040.466] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.467] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.467] CryptHashData (hHash=0x5c9040, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.467] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0040.467] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.467] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.467] GetLastError () returned 0xea [0040.467] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.467] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\owlvmzrc\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.468] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.469] SetEndOfFile (hFile=0x108) returned 1 [0040.469] CloseHandle (hObject=0x108) returned 1 [0040.469] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.469] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.469] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.470] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.470] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89b7790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.470] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89b7790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.470] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.470] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="OWLVMZRC", cAlternateFileName="")) returned 0 [0040.470] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.470] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1 [0040.470] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8991630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8991630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8991630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.470] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x95014270, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0040.470] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Recovery", cAlternateFileName="")) returned 1 [0040.470] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.471] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.471] CryptHashData (hHash=0x5c9140, pbData=0x33e1930, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.471] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0040.471] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.471] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.471] GetLastError () returned 0xea [0040.471] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.471] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.472] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.473] SetEndOfFile (hFile=0xf0) returned 1 [0040.473] CloseHandle (hObject=0xf0) returned 1 [0040.473] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.473] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.473] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.473] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.473] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Active", cAlternateFileName="")) returned 1 [0040.473] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.474] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.474] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.474] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0040.474] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.474] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.474] GetLastError () returned 0xea [0040.474] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.474] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.475] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.476] SetEndOfFile (hFile=0x108) returned 1 [0040.476] CloseHandle (hObject=0x108) returned 1 [0040.476] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.476] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.476] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.477] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.477] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89b7790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.477] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89b7790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.477] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.477] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89b7790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89b7790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89b7790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.477] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1 [0040.477] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.478] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.478] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.478] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9140) returned 1 [0040.478] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.478] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.478] GetLastError () returned 0xea [0040.478] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.478] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.479] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.480] SetEndOfFile (hFile=0x108) returned 1 [0040.481] CloseHandle (hObject=0x108) returned 1 [0040.481] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.481] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.481] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89dd8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.481] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89dd8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.481] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89dd8f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89dd8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.481] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 1 [0040.481] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6dd28c60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6dd28c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 1 [0040.481] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{4BD65~1.DAT")) returned 1 [0040.481] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 1 [0040.481] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 0 [0040.481] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.481] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 0 [0040.481] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.481] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Recovery", cAlternateFileName="")) returned 0 [0040.481] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.482] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20455254, dwReserved1=0x52434e45, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0040.482] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.482] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.482] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.482] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0040.482] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.482] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.482] GetLastError () returned 0xea [0040.482] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.483] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.483] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.484] SetEndOfFile (hFile=0xe8) returned 1 [0040.484] CloseHandle (hObject=0xe8) returned 1 [0040.485] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.485] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.485] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89dd8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.485] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89dd8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.485] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1 [0040.485] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89dd8f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89dd8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.485] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1 [0040.485] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1 [0040.485] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.486] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.486] CryptHashData (hHash=0x5c9100, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.486] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9140) returned 1 [0040.486] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.486] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.486] GetLastError () returned 0xea [0040.486] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.486] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.487] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.488] SetEndOfFile (hFile=0xf0) returned 1 [0040.488] CloseHandle (hObject=0xf0) returned 1 [0040.488] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.488] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.488] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89dd8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.488] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89dd8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.488] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0040.488] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.489] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.489] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.489] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0040.489] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.489] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.489] GetLastError () returned 0xea [0040.489] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.489] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.490] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.491] SetEndOfFile (hFile=0x108) returned 1 [0040.491] CloseHandle (hObject=0x108) returned 1 [0040.492] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.492] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.492] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89dd8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.492] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89dd8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.492] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0000E713", cAlternateFileName="")) returned 1 [0040.492] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.492] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.492] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.492] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9180) returned 1 [0040.492] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.492] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ea70) returned 0 [0040.492] GetLastError () returned 0xea [0040.493] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.493] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.494] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.495] SetEndOfFile (hFile=0x114) returned 1 [0040.495] CloseHandle (hObject=0x114) returned 1 [0040.496] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.496] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.496] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8a03a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8a03a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a03a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a03a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a03a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a03a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.496] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.496] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="00010C6E", cAlternateFileName="")) returned 1 [0040.496] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.497] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.497] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.497] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0040.497] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.497] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ea70) returned 0 [0040.497] GetLastError () returned 0xea [0040.497] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.498] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.499] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.500] SetEndOfFile (hFile=0x114) returned 1 [0040.500] CloseHandle (hObject=0x114) returned 1 [0040.500] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.500] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.500] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8a03a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.500] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8a03a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.500] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0040.500] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1 [0040.500] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1 [0040.500] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a03a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a03a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a03a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a03a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.501] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89dd8f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89dd8f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.501] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89dd8f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89dd8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa89dd8f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa89dd8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa89dd8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.501] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.501] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1 [0040.501] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.502] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.502] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.502] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0040.502] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.502] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.502] GetLastError () returned 0xea [0040.502] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.502] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\transcoded files cache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.503] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.504] SetEndOfFile (hFile=0xf0) returned 1 [0040.504] CloseHandle (hObject=0xf0) returned 1 [0040.504] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.504] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.504] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xa8a03a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.505] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xa8a03a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.505] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a03a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a03a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.505] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a03a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a03a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a03a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.505] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.505] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 0 [0040.505] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.505] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6946, dwReserved1=0x61432073, cFileName="Office", cAlternateFileName="")) returned 1 [0040.505] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.505] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.505] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.506] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0040.506] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.506] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.506] GetLastError () returned 0xea [0040.506] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.506] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.507] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.508] SetEndOfFile (hFile=0xe8) returned 1 [0040.508] CloseHandle (hObject=0xe8) returned 1 [0040.509] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.509] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.509] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.509] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.509] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="14.0", cAlternateFileName="")) returned 1 [0040.509] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.510] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.510] CryptHashData (hHash=0x5c8ec0, pbData=0x1fc6440, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.510] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9140) returned 1 [0040.510] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.510] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.510] GetLastError () returned 0xea [0040.510] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.510] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.511] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.512] SetEndOfFile (hFile=0xf0) returned 1 [0040.512] CloseHandle (hObject=0xf0) returned 1 [0040.512] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.512] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.512] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.512] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.512] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a29bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.512] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1 [0040.512] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.513] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.513] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.513] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9100) returned 1 [0040.513] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.513] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.513] GetLastError () returned 0xea [0040.513] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.513] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.515] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.516] SetEndOfFile (hFile=0x108) returned 1 [0040.516] CloseHandle (hObject=0x108) returned 1 [0040.516] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.516] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.516] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.517] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.517] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="FSD-CNRY.FSD", cAlternateFileName="")) returned 1 [0040.517] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", cAlternateFileName="FSD-{4~1.FSD")) returned 1 [0040.517] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 1 [0040.517] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a29bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.517] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a29bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.517] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.517] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 0 [0040.517] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.517] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65686361, dwReserved1=0x52434e45, cFileName="Groove", cAlternateFileName="")) returned 1 [0040.517] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.518] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.518] CryptHashData (hHash=0x5c9140, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.518] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0040.518] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.518] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.518] GetLastError () returned 0xea [0040.518] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.518] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.519] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.519] SetEndOfFile (hFile=0xf0) returned 1 [0040.520] CloseHandle (hObject=0xf0) returned 1 [0040.520] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.520] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.520] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.520] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.520] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a29bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.520] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="System", cAlternateFileName="")) returned 1 [0040.520] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.521] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.521] CryptHashData (hHash=0x5c9140, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.521] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0040.521] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.521] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.521] GetLastError () returned 0xea [0040.521] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.521] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\system\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.521] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.522] SetEndOfFile (hFile=0x108) returned 1 [0040.523] CloseHandle (hObject=0x108) returned 1 [0040.523] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.523] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.523] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.523] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.523] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a29bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a4fd10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.523] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a29bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a4fd10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.523] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.523] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="User", cAlternateFileName="")) returned 1 [0040.523] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.524] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.524] CryptHashData (hHash=0x5c8ec0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.524] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9140) returned 1 [0040.524] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.524] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.524] GetLastError () returned 0xea [0040.524] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.524] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\user\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.525] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.525] SetEndOfFile (hFile=0x108) returned 1 [0040.526] CloseHandle (hObject=0x108) returned 1 [0040.526] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.526] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.526] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xa8a4fd10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a4fd10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.526] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xa8a4fd10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a4fd10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.526] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a4fd10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a4fd10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a4fd10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.526] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a4fd10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a4fd10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a4fd10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.526] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.526] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="User", cAlternateFileName="")) returned 0 [0040.526] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.526] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a29bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a29bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a29bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.526] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1 [0040.526] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.527] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.527] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.527] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9140) returned 1 [0040.527] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.527] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.527] GetLastError () returned 0xea [0040.527] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.527] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.529] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.530] SetEndOfFile (hFile=0xf0) returned 1 [0040.530] CloseHandle (hObject=0xf0) returned 1 [0040.530] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.530] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.530] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8a4fd10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a4fd10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.530] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8a4fd10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a4fd10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.531] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 1 [0040.531] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 1 [0040.531] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a4fd10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a4fd10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a4fd10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.531] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a4fd10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a4fd10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a4fd10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.531] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.531] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 0 [0040.531] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.531] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Outlook", cAlternateFileName="")) returned 1 [0040.531] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.531] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.531] CryptHashData (hHash=0x5c9040, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.531] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9140) returned 1 [0040.531] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.532] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.532] GetLastError () returned 0xea [0040.532] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.532] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.534] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.535] SetEndOfFile (hFile=0xe8) returned 1 [0040.535] CloseHandle (hObject=0xe8) returned 1 [0040.535] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.535] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.535] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xa8a4fd10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a4fd10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.535] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xa8a4fd10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a4fd10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.536] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a4fd10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a4fd10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a4fd10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.536] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1 [0040.536] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4d2d00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 1 [0040.536] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1 [0040.536] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.536] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.536] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.536] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0040.536] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.536] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.536] GetLastError () returned 0xea [0040.536] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.537] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.539] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.540] SetEndOfFile (hFile=0xf0) returned 1 [0040.540] CloseHandle (hObject=0xf0) returned 1 [0040.540] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.540] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.540] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.540] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.540] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a4fd10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a4fd10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.540] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0040.540] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0040.540] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.541] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 0 [0040.541] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.541] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676e6972, dwReserved1=0x6c6d782e, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0040.541] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.541] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.541] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.541] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0040.541] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.541] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.541] GetLastError () returned 0xea [0040.541] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.542] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\publisher\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.542] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.543] SetEndOfFile (hFile=0xe8) returned 1 [0040.543] CloseHandle (hObject=0xe8) returned 1 [0040.543] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.543] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.543] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.544] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.544] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a75e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.544] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a75e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.544] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.544] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1 [0040.544] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.545] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.545] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.545] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9140) returned 1 [0040.545] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.545] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.545] GetLastError () returned 0xea [0040.545] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.545] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\taskschedulerconfig\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.546] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.547] SetEndOfFile (hFile=0xe8) returned 1 [0040.547] CloseHandle (hObject=0xe8) returned 1 [0040.547] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.547] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.547] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.547] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.547] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a75e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.547] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a75e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.547] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.547] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Visio", cAlternateFileName="")) returned 1 [0040.548] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.548] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.548] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.548] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0040.548] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.548] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.548] GetLastError () returned 0xea [0040.548] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.549] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.549] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.550] SetEndOfFile (hFile=0xe8) returned 1 [0040.550] CloseHandle (hObject=0xe8) returned 1 [0040.550] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.550] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.550] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.551] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.551] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1 [0040.551] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a75e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.551] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbs.dat", cAlternateFileName="")) returned 1 [0040.551] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbs.dat", cAlternateFileName="")) returned 0 [0040.551] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.551] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows", cAlternateFileName="")) returned 1 [0040.551] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.551] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.551] CryptHashData (hHash=0x5c9100, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.551] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9140) returned 1 [0040.551] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.551] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.552] GetLastError () returned 0xea [0040.552] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.552] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.553] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.554] SetEndOfFile (hFile=0xe8) returned 1 [0040.554] CloseHandle (hObject=0xe8) returned 1 [0040.554] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.554] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.554] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.554] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a75e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.554] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1024", cAlternateFileName="")) returned 1 [0040.554] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.555] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.555] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.555] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0040.555] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.555] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.555] GetLastError () returned 0xea [0040.555] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.555] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1024\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.556] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.557] SetEndOfFile (hFile=0xf0) returned 1 [0040.557] CloseHandle (hObject=0xf0) returned 1 [0040.557] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.557] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.557] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1024\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.557] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.557] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a9bfd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.557] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a9bfd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.557] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.557] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="1033", cAlternateFileName="")) returned 1 [0040.558] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.558] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.558] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.558] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0040.558] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.558] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.558] GetLastError () returned 0xea [0040.558] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.559] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.559] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.560] SetEndOfFile (hFile=0xf0) returned 1 [0040.560] CloseHandle (hObject=0xf0) returned 1 [0040.560] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.560] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.560] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.561] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.561] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a9bfd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.561] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1 [0040.561] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0 [0040.561] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.561] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x79726575, dwReserved1=0x65686353, cFileName="Burn", cAlternateFileName="")) returned 1 [0040.561] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.562] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.562] CryptHashData (hHash=0x5c9100, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.562] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0040.562] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.562] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.562] GetLastError () returned 0xea [0040.562] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.562] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.564] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.565] SetEndOfFile (hFile=0xf0) returned 1 [0040.566] CloseHandle (hObject=0xf0) returned 1 [0040.566] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.566] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.566] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.566] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.566] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa27d2ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27d2ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Burn", cAlternateFileName="")) returned 1 [0040.566] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.567] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.567] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.567] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0040.567] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.567] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.567] GetLastError () returned 0xea [0040.567] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.567] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.568] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.569] SetEndOfFile (hFile=0x108) returned 1 [0040.569] CloseHandle (hObject=0x108) returned 1 [0040.569] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.569] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.569] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.569] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.569] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa27acd70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa27acd70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27d2ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.569] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a9bfd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.570] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a9bfd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.570] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.570] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa27d2ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27d2ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Burn1", cAlternateFileName="")) returned 1 [0040.570] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.570] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.570] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.570] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9100) returned 1 [0040.570] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.570] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.570] GetLastError () returned 0xea [0040.570] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.571] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.571] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.572] SetEndOfFile (hFile=0x108) returned 1 [0040.572] CloseHandle (hObject=0x108) returned 1 [0040.573] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.573] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.573] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.573] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.573] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa27d2ed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa27d2ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27d2ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.573] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ac2130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.573] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ac2130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.573] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.573] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0xa27d2ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27d2ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Burn2", cAlternateFileName="")) returned 1 [0040.573] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.574] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.574] CryptHashData (hHash=0x5c9100, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.574] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0040.574] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.574] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.574] GetLastError () returned 0xea [0040.574] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.574] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.575] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.575] SetEndOfFile (hFile=0x108) returned 1 [0040.576] CloseHandle (hObject=0x108) returned 1 [0040.576] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.576] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.576] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.576] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.576] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa27d2ed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa27d2ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27d2ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.576] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ac2130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.576] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ac2130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.576] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.576] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a9bfd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.576] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a9bfd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a9bfd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.576] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.576] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Caches", cAlternateFileName="")) returned 1 [0040.576] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.577] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.577] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.577] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0040.577] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.577] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.577] GetLastError () returned 0xea [0040.577] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.577] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.578] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.579] SetEndOfFile (hFile=0xf0) returned 1 [0040.579] CloseHandle (hObject=0xf0) returned 1 [0040.579] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.579] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.579] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.579] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.579] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1 [0040.579] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ac2130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.579] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x408bd0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x408bd0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x408bd0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x18388, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", cAlternateFileName="{AFBF9~3.DB")) returned 1 [0040.579] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 1 [0040.579] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 0 [0040.579] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.579] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d384545, dwReserved1=0x37374334, cFileName="Explorer", cAlternateFileName="")) returned 1 [0040.579] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.580] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.580] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.580] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0040.580] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.580] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.580] GetLastError () returned 0xea [0040.580] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.580] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.581] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.582] SetEndOfFile (hFile=0xf0) returned 1 [0040.582] CloseHandle (hObject=0xf0) returned 1 [0040.582] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.582] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.582] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.582] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.582] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1 [0040.582] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x841d6620, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1 [0040.582] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ac2130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.582] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1 [0040.582] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 1 [0040.582] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 1 [0040.582] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x962e8480, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1 [0040.582] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 1 [0040.583] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 1 [0040.583] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 0 [0040.583] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.583] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x52626262, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0040.583] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.583] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.583] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.583] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0040.583] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.583] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.583] GetLastError () returned 0xea [0040.583] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.584] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\gameexplorer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.585] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.586] SetEndOfFile (hFile=0xf0) returned 1 [0040.586] CloseHandle (hObject=0xf0) returned 1 [0040.586] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.586] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.586] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.586] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ac2130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.586] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ac2130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.586] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ac2130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ac2130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.586] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.586] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa88d2f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88d2f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="History", cAlternateFileName="")) returned 1 [0040.586] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.587] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.587] CryptHashData (hHash=0x5c8ec0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.587] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0040.587] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.587] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.587] GetLastError () returned 0xea [0040.587] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.587] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.588] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.588] SetEndOfFile (hFile=0xf0) returned 1 [0040.588] CloseHandle (hObject=0xf0) returned 1 [0040.588] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.588] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.588] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa88d2f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88d2f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.588] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa88d2f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa88d2f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.588] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f9030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa27f9030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27f9030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.588] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa27f9030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27f9030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0040.588] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.589] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.589] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.589] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9100) returned 1 [0040.589] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.589] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.589] GetLastError () returned 0xea [0040.589] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.589] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.590] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.591] SetEndOfFile (hFile=0x108) returned 1 [0040.591] CloseHandle (hObject=0x108) returned 1 [0040.591] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.591] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.591] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ae8290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.591] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ae8290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.591] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f9030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa27f9030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27f9030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.591] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ae8290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ae8290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.591] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x9b4223a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0040.591] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96a327e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96a327e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96a327e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSHist012019071920190720", cAlternateFileName="MSHIST~1")) returned 1 [0040.591] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.592] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.592] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.592] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9180) returned 1 [0040.592] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.592] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ea70) returned 0 [0040.592] GetLastError () returned 0xea [0040.592] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.592] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019071920190720\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019071920190720\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.593] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.594] SetEndOfFile (hFile=0x114) returned 1 [0040.594] CloseHandle (hObject=0x114) returned 1 [0040.594] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.594] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.594] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019071920190720\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96a327e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ae8290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.594] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96a327e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ae8290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.594] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ae8290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ae8290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.594] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x96a327e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96a327e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0040.594] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x96a327e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96a327e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 0 [0040.594] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.594] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x96a327e0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x96a327e0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x96a327e0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSHist012019071920190720", cAlternateFileName="MSHIST~1")) returned 0 [0040.594] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.594] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa88d2f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa88d2f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.594] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa281f190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa281f190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName="Low", cAlternateFileName="")) returned 1 [0040.594] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.595] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.595] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.595] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9180) returned 1 [0040.595] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.595] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.595] GetLastError () returned 0xea [0040.595] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.595] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.596] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.597] SetEndOfFile (hFile=0x108) returned 1 [0040.597] CloseHandle (hObject=0x108) returned 1 [0040.597] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.597] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.597] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ae8290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.597] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ae8290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.597] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f9030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa27f9030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa27f9030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.597] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa281f190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa281f190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0040.597] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.598] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.598] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.598] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c8ec0) returned 1 [0040.598] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.598] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ea70) returned 0 [0040.598] GetLastError () returned 0xea [0040.598] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.598] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.598] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.599] SetEndOfFile (hFile=0x114) returned 1 [0040.599] CloseHandle (hObject=0x114) returned 1 [0040.599] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.600] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.600] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8ae8290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.600] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8ae8290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.600] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa281f190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa281f190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa281f190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.600] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ae8290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ae8290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.600] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0040.600] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1 [0040.600] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.601] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.601] CryptHashData (hHash=0x5c9100, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.601] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c91c0) returned 1 [0040.601] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.601] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18e808) returned 0 [0040.601] GetLastError () returned 0xea [0040.601] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.601] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.602] WriteFile (in: hFile=0x104, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.603] SetEndOfFile (hFile=0x104) returned 1 [0040.603] CloseHandle (hObject=0x104) returned 1 [0040.603] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.603] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.603] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0xa8b0e3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b0e3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.603] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0xa8b0e3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b0e3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.603] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b0e3f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b0e3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b0e3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.603] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0040.603] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 0 [0040.603] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.603] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 0 [0040.603] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.603] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ae8290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ae8290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x31373037, dwReserved1=0x31303232, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.603] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ae8290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ae8290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ae8290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x31373037, dwReserved1=0x31303232, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.603] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.603] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa281f190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa281f190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31373039, dwReserved1=0x31303239, cFileName="Low", cAlternateFileName="")) returned 0 [0040.603] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.603] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8a75e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8a75e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8a9bfd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.604] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0040.604] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.604] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.604] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.604] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9180) returned 1 [0040.604] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.604] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.604] GetLastError () returned 0xea [0040.604] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.605] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\ringtones\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.607] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.608] SetEndOfFile (hFile=0xf0) returned 1 [0040.608] CloseHandle (hObject=0xf0) returned 1 [0040.609] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.609] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.609] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b0e3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b0e3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.609] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b0e3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b0e3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.609] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b0e3f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b0e3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b0e3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.609] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b0e3f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b0e3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b0e3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.609] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.609] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa28915b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa28915b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0040.609] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.610] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.610] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.610] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0040.610] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.610] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.610] GetLastError () returned 0xea [0040.610] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.610] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.611] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.612] SetEndOfFile (hFile=0xf0) returned 1 [0040.612] CloseHandle (hObject=0xf0) returned 1 [0040.612] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.612] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.612] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b0e3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b0e3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.612] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b0e3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b0e3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.612] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa281f190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa281f190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0040.612] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.613] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.613] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.613] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0040.613] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.613] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.613] GetLastError () returned 0xea [0040.613] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.613] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.614] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.615] SetEndOfFile (hFile=0x108) returned 1 [0040.615] CloseHandle (hObject=0x108) returned 1 [0040.615] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.615] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.616] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b0e3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b0e3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.616] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b0e3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b0e3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.616] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa281f190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa281f190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa281f190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.616] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b0e3f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b0e3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b0e3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.616] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x9b4223a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0040.616] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa28452f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa28452f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1 [0040.616] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.616] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.616] CryptHashData (hHash=0x5c9180, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.616] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c91c0) returned 1 [0040.616] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.616] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ea70) returned 0 [0040.617] GetLastError () returned 0xea [0040.617] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.617] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.617] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.618] SetEndOfFile (hFile=0x114) returned 1 [0040.618] CloseHandle (hObject=0x114) returned 1 [0040.618] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.618] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.618] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.618] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.619] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28452f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa28452f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa28452f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.619] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b34550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.619] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b34550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.619] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.619] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa28452f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa28452f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1 [0040.619] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.619] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.619] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.619] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9180) returned 1 [0040.619] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0040.619] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ea70) returned 0 [0040.619] GetLastError () returned 0xea [0040.619] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.620] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.620] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.621] SetEndOfFile (hFile=0x114) returned 1 [0040.621] CloseHandle (hObject=0x114) returned 1 [0040.621] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.621] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.621] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.621] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.622] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28452f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa28452f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa28452f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.622] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b34550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.622] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b34550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.622] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.622] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa286b450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa286b450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1 [0040.622] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.622] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.622] CryptHashData (hHash=0x5c9180, pbData=0x33e2058, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.622] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c91c0) returned 1 [0040.622] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.622] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ea70) returned 0 [0040.622] GetLastError () returned 0xea [0040.623] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.623] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.623] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.624] SetEndOfFile (hFile=0x114) returned 1 [0040.624] CloseHandle (hObject=0x114) returned 1 [0040.624] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.624] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.624] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.624] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.624] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa286b450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa286b450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa286b450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.624] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b34550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.625] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b34550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.625] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.625] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa286b450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa286b450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="X9OHK109", cAlternateFileName="")) returned 1 [0040.625] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.625] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.625] CryptHashData (hHash=0x5c91c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.625] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9180) returned 1 [0040.625] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0040.625] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ea70) returned 0 [0040.625] GetLastError () returned 0xea [0040.625] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.626] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.626] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.627] SetEndOfFile (hFile=0x114) returned 1 [0040.627] CloseHandle (hObject=0x114) returned 1 [0040.627] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.627] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.627] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.627] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.627] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa286b450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa286b450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa286b450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.627] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b34550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.627] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b34550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.628] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.628] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa286b450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa286b450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="X9OHK109", cAlternateFileName="")) returned 0 [0040.628] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.628] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Content.MSO", cAlternateFileName="")) returned 1 [0040.628] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.628] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.628] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.628] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9180) returned 1 [0040.628] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.628] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.628] GetLastError () returned 0xea [0040.628] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.629] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.mso\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.630] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.630] SetEndOfFile (hFile=0x108) returned 1 [0040.630] CloseHandle (hObject=0x108) returned 1 [0040.631] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.631] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.631] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.631] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b34550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.631] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b34550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b34550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b34550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.631] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.631] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1 [0040.631] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.632] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.632] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.632] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0040.632] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.632] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.632] GetLastError () returned 0xea [0040.632] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.632] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.word\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.633] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.634] SetEndOfFile (hFile=0x108) returned 1 [0040.634] CloseHandle (hObject=0x108) returned 1 [0040.634] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.634] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.634] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.635] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.635] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b5a6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.635] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b5a6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.635] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.635] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa286b450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa286b450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa28915b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.635] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b0e3f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b0e3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b0e3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.635] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa4085310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4085310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Low", cAlternateFileName="")) returned 1 [0040.635] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.636] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.636] CryptHashData (hHash=0x5c8ec0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.636] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9180) returned 1 [0040.636] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.636] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.636] GetLastError () returned 0xea [0040.636] CryptEncrypt (in: hKey=0x5c9180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.636] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.636] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.637] SetEndOfFile (hFile=0x108) returned 1 [0040.637] CloseHandle (hObject=0x108) returned 1 [0040.637] CryptDestroyKey (hKey=0x5c9180) returned 1 [0040.637] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.637] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9180 [0040.638] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.638] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AntiPhishing", cAlternateFileName="ANTIPH~1")) returned 1 [0040.638] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.638] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.638] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.638] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c91c0) returned 1 [0040.638] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.638] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ea70) returned 0 [0040.638] GetLastError () returned 0xea [0040.638] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.639] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.639] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.641] SetEndOfFile (hFile=0x114) returned 1 [0040.641] CloseHandle (hObject=0x114) returned 1 [0040.641] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.642] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.642] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.642] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.642] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 1 [0040.642] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b5a6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.642] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b5a6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.642] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.642] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa3582d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3582d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0040.642] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.643] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.643] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.643] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c8ec0) returned 1 [0040.643] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0040.643] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ea70) returned 0 [0040.643] GetLastError () returned 0xea [0040.643] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.643] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.644] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.644] SetEndOfFile (hFile=0x114) returned 1 [0040.645] CloseHandle (hObject=0x114) returned 1 [0040.645] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.645] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.645] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.645] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.645] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa2e5eb50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2e5eb50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="9QH4S0GZ", cAlternateFileName="")) returned 1 [0040.645] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.645] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.645] CryptHashData (hHash=0x5c91c0, pbData=0x33e2058, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.646] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9100) returned 1 [0040.646] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0040.646] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18e808) returned 0 [0040.646] GetLastError () returned 0xea [0040.646] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.646] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.646] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.648] SetEndOfFile (hFile=0x104) returned 1 [0040.648] CloseHandle (hObject=0x104) returned 1 [0040.648] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.648] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.648] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.648] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdbb73b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdbb73b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdc03670, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x39d41, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="28-8f3193-f30905ea[1]", cAlternateFileName="28-8F3~1")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x551dcf90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x551dcf90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5529b670, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="528d82a2[1].js", cAlternateFileName="528D82~1.JS")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28915b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa28915b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa28915b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x135, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA3e3XC[2].png.crypt", cAlternateFileName="AA3E3X~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28915b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa28915b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa28b7710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA3vOVA[1].png.crypt", cAlternateFileName="AA3VOV~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28b7710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa28b7710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa28b7710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA42EP9[1].png.crypt", cAlternateFileName="AA42EP~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28b7710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa28b7710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa28b7710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA54rQj[1].png.crypt", cAlternateFileName="AA54RQ~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28b7710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa28b7710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa28dd870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA61yi9[1].png.crypt", cAlternateFileName="AA61YI~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28dd870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa28dd870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa28dd870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA8uCo4[1].png.crypt", cAlternateFileName="AA8UCO~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28dd870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa28dd870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa29039d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAdAVrM[1].png.crypt", cAlternateFileName="AADAVR~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4697f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4697f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4b5ab0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x21e7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="adServer[1].htm", cAlternateFileName="ADSERV~1.HTM")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="advertisement.ad[1].js", cAlternateFileName="ADVERT~1.JS")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x545d0030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545d0030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x545d0030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x534, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="async_usersync[2]", cAlternateFileName="ASYNC_~2")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe9ff7b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe9ff7b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe9ff7b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="async_usersync[3]", cAlternateFileName="ASYNC_~3")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa29039d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa29039d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa29039d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BB1CcOi[1].png.crypt", cAlternateFileName="BB1CCO~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa29039d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa29039d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa29039d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BB46JmN[1].png.crypt", cAlternateFileName="BB46JM~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2929b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2929b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2929b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x120, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BB5kJAC[1].png.crypt", cAlternateFileName="BB5KJA~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2929b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2929b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2929b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BB5kTiV[1].png.crypt", cAlternateFileName="BB5KTI~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2929b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2929b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa294fc90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x18c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BB6Ma4a[1].png.crypt", cAlternateFileName="BB6MA4~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa294fc90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa294fc90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa294fc90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BB74fLs[1].png.crypt", cAlternateFileName="BB74FL~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa294fc90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa294fc90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa294fc90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x333f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBIqq8[1].jpg.crypt", cAlternateFileName="BBBIQQ~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2975df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2975df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2975df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x90b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBL0ij[1].jpg.crypt", cAlternateFileName="BBBL0I~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2975df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2975df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa299bf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBLhZX[1].jpg.crypt", cAlternateFileName="BBBLHZ~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa29c20b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa29c20b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa29c20b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x28b9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBNiEo[1].jpg.crypt", cAlternateFileName="BBBNIE~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa29c20b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa29c20b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa29c20b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x176d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBO1mQ[1].jpg.crypt", cAlternateFileName="BBBO1M~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa29c20b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa29c20b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa29e8210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6218, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBO3tl[1].jpg.crypt", cAlternateFileName="BBBO3T~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa29e8210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa29e8210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa29e8210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBO8dQ[1].jpg.crypt", cAlternateFileName="BBBO8D~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa29e8210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa29e8210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2a0e370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2d89, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBOe7C[1].jpg.crypt", cAlternateFileName="BBBOE7~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a0e370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2a0e370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2a0e370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1e36, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBPThN[1].jpg.crypt", cAlternateFileName="BBBPTH~1.CRY")) returned 1 [0040.649] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a0e370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2a0e370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2a344d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1ee7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBPUFJ[1].jpg.crypt", cAlternateFileName="BBBPUF~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a344d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2a344d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2a344d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBQxzx[1].jpg.crypt", cAlternateFileName="BBBQXZ~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a344d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2a344d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2a5a630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBseMP[1].jpg.crypt", cAlternateFileName="BBBSEM~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a5a630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2a5a630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2a5a630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x16d6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBsqNL[1].jpg.crypt", cAlternateFileName="BBBSQN~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a5a630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2a5a630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2a5a630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7ae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBTpvW[1].jpg.crypt", cAlternateFileName="BBBTPV~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a5a630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2a5a630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2a80790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBVEOW[1].jpg.crypt", cAlternateFileName="BBBVEO~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a80790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2a80790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2a80790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1e67, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBVGsM[1].jpg.crypt", cAlternateFileName="BBBVGS~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a80790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2a80790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2aa68f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xaa8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBVIzI[1].jpg.crypt", cAlternateFileName="BBBVIZ~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2aa68f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2aa68f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2aa68f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x97a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBVJ4r[1].jpg.crypt", cAlternateFileName="BBBVJ4~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2aa68f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2aa68f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2aa68f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7d8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBVxM8[1].jpg.crypt", cAlternateFileName="BBBVXM~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2acca50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2acca50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2acca50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBz9wz[1].jpg.crypt", cAlternateFileName="BBBZ9W~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2acca50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2acca50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2acca50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x24be, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBzxW1[1].jpg.crypt", cAlternateFileName="BBBZXW~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2acca50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2acca50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2af2bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x33a8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC06Ub[1].jpg.crypt", cAlternateFileName="BBC06U~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2af2bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2af2bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2af2bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC095c[1].jpg.crypt", cAlternateFileName="BBC095~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2af2bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2af2bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2b18d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x17a5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0ALC[1].jpg.crypt", cAlternateFileName="BBC0AL~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2b18d10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2b18d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2b18d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2720, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0lYn[1].jpg.crypt", cAlternateFileName="BBC0LY~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2b18d10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2b18d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2b18d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x522, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0mlu[1].jpg.crypt", cAlternateFileName="BBC0ML~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2b3ee70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2b3ee70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2b3ee70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x188f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0rDa[1].jpg.crypt", cAlternateFileName="BBC0RD~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2b3ee70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2b3ee70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2b3ee70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7fe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0rDa[2].jpg.crypt", cAlternateFileName="BBC0RD~2.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2b3ee70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2b3ee70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2b64fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x320d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0tCi[1].jpg.crypt", cAlternateFileName="BBC0TC~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2b64fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2b64fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2b64fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x28f2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBDK7Yy[1].jpg.crypt", cAlternateFileName="BBDK7Y~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2b8b130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2b8b130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2b8b130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBDRbsH[1].jpg.crypt", cAlternateFileName="BBDRBS~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2b8b130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2b8b130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2b8b130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x968, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBDZoZR[1].jpg.crypt", cAlternateFileName="BBDZOZ~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2b8b130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2b8b130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2b8b130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8d4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBE97O8[1].jpg.crypt", cAlternateFileName="BBE97O~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2bb1290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2bb1290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2bb1290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6e0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBE9wSt[1].jpg.crypt", cAlternateFileName="BBE9WS~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2bb1290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2bb1290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2bb1290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8b9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEcHle[1].jpg.crypt", cAlternateFileName="BBECHL~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2bd73f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2bd73f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2bd73f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2086, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEdE0f[1].jpg.crypt", cAlternateFileName="BBEDE0~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2bd73f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2bd73f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2bd73f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEdoQv[1].jpg.crypt", cAlternateFileName="BBEDOQ~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2bfd550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2bfd550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2bfd550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEdqEy[1].jpg.crypt", cAlternateFileName="BBEDQE~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2bfd550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2bfd550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2bfd550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6d0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEdtWw[1].jpg.crypt", cAlternateFileName="BBEDTW~1.CRY")) returned 1 [0040.650] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2c236b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2c236b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2c236b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x687, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEdXJj[1].jpg.crypt", cAlternateFileName="BBEDXJ~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2c236b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2c236b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2c236b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeP0k[1].jpg.crypt", cAlternateFileName="BBEEP0~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2c49810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2c49810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2c49810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3417, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeTuf[1].jpg.crypt", cAlternateFileName="BBEETU~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2c6f970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2c6f970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2c6f970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xc0b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfE6e[1].jpg.crypt", cAlternateFileName="BBEFE6~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2c6f970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2c6f970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2c6f970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3c4c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfjuT[1].jpg.crypt", cAlternateFileName="BBEFJU~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2c95ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2c95ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2c95ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f0e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEg9QV[1].jpg.crypt", cAlternateFileName="BBEG9Q~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2c95ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2c95ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2c95ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgGSl[1].jpg.crypt", cAlternateFileName="BBEGGS~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2cbbc30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2cbbc30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2cbbc30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgiYw[1].jpg.crypt", cAlternateFileName="BBEGIY~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2cbbc30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2cbbc30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2ce1d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1a59, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgJfz[1].jpg.crypt", cAlternateFileName="BBEGJF~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2ce1d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2ce1d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2ce1d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7b0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgqtY[1].jpg.crypt", cAlternateFileName="BBEGQT~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2ce1d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2ce1d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2d07ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x44ec, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgsz3[1].jpg.crypt", cAlternateFileName="BBEGSZ~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2d07ef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2d07ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2d07ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x171b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgtcS[1].jpg.crypt", cAlternateFileName="BBEGTC~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2d541b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2d541b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2d541b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1826, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgtcS[2].jpg.crypt", cAlternateFileName="BBEGTC~2.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2d7a310, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2d7a310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2d7a310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgx5f[1].jpg.crypt", cAlternateFileName="BBEGX5~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2d7a310, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2d7a310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2d7a310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5e5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgx5f[2].jpg.crypt", cAlternateFileName="BBEGX5~2.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2d7a310, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2d7a310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2da0470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3565, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgyIm[1].jpg.crypt", cAlternateFileName="BBEGYI~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2da0470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2da0470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2da0470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBg3ODX[2].png.crypt", cAlternateFileName="BBG3OD~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2da0470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2da0470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2da0470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBiyCq[1].png.crypt", cAlternateFileName="BBIYCQ~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2dc65d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2dc65d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2dc65d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBn4lUU[1].png.crypt", cAlternateFileName="BBN4LU~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2dc65d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2dc65d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2dc65d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBnMKeN[1].png.crypt", cAlternateFileName="BBNMKE~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2dec730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2dec730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2dec730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x38b7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBwGan9[1].jpg.crypt", cAlternateFileName="BBWGAN~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2dec730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2dec730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2dec730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBz3ebk[1].png.crypt", cAlternateFileName="BBZ3EB~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2e12890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2e12890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2e12890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x29ed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="benefits-5-mobile[1].png.crypt", cAlternateFileName="BENEFI~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61804060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61804060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61850320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f3f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2e12890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2e12890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2e389f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x10c6c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="chrome-new[1].jpg.crypt", cAlternateFileName="CHROME~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60aec760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60aec760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60b128c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4739, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot", cAlternateFileName="CJZKEO~1.EOT")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53b8c150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b8c150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53bb22b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe6dfad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe6dfad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe6dfad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ContainerTag[2].js", cAlternateFileName="CONTAI~2.JS")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2e389f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2e389f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2e389f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="css[2].txt.crypt", cAlternateFileName="CSS_2_~1.CRY")) returned 1 [0040.651] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2e389f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2e389f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2e389f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5114bad0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5114bad0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x511bdef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39a21, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="f8-028d9f-f30905ea[1]", cAlternateFileName="F8-028~1")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2e5eb50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2e5eb50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2e5eb50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7f78, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fallback_728x90[1].jpg.crypt", cAlternateFileName="FALLBA~1.CRY")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53063a30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53063a30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53063a30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xca2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbde189b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbde189b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbde189b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1305, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~2")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b5a6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b80810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2e5eb50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2e5eb50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2e5eb50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ie8[1].txt.crypt", cAlternateFileName="IE8_1_~1.CRY")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bff750, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bff750, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bff750, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54e4ae90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54e4ae90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e4ae90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x88e7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1180, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="meversion[1]", cAlternateFileName="MEVERS~1")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfaa91b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfaa91b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfaa91b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x56ed3860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56ed3860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x56ed3860, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Passport[1].htm", cAlternateFileName="PASSPO~1.HTM")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61282d80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61282d80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x9f32, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="plusone[1].js", cAlternateFileName="PLUSON~1.JS")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6371bfc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6371bfc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6371bfc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="postmessageRelay[1].htm", cAlternateFileName="POSTME~1.HTM")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555ac120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555ac120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55a97d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a6f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="search[1].htm", cAlternateFileName="SEARCH~1.HTM")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54772f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54772f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54772f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c85b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="uhf-west-european-default.min[1].css", cAlternateFileName="UHF-WE~1.CSS")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54726c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54726c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54726c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WebCore.4.19.0.ltr.light.min[1].css", cAlternateFileName="WEBCOR~1.CSS")) returned 0 [0040.652] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.652] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa3582d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3582d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e302e39, dwReserved1=0x2e72746c, cFileName="ABV8L7MY", cAlternateFileName="")) returned 1 [0040.652] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.653] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.653] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.653] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c91c0) returned 1 [0040.653] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.653] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18e808) returned 0 [0040.653] GetLastError () returned 0xea [0040.653] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.653] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.654] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.654] SetEndOfFile (hFile=0x104) returned 1 [0040.655] CloseHandle (hObject=0x104) returned 1 [0040.655] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.655] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.655] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8b80810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b80810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8b80810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b80810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa36d90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa36d90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfa83050, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xe455, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="000000929096[1].gif", cAlternateFileName="000000~1.GIF")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6384cac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6384cac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6384cac0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2929, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1223855322-postmessagerelay[1].js", cAlternateFileName="122385~1.JS")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2e84cb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2e84cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2e84cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA3e1oO[1].png.crypt", cAlternateFileName="AA3E1O~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2e84cb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2e84cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2e84cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA429NP[1].png.crypt", cAlternateFileName="AA429N~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2eaae10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2eaae10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2eaae10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA42pjY[1].png.crypt", cAlternateFileName="AA42PJ~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2eaae10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2eaae10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2eaae10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA61AKN[2].png.crypt", cAlternateFileName="AA61AK~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2eaae10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2eaae10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2eaae10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA6KizP[2].png.crypt", cAlternateFileName="AA6KIZ~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2ed0f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2ed0f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2ed0f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x27b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA7XCQ3[1].png.crypt", cAlternateFileName="AA7XCQ~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2ed0f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2ed0f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2ed0f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA8Tave[1].png.crypt", cAlternateFileName="AA8TAV~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2ef70d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2ef70d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2ef70d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAfOIDq[1].png.crypt", cAlternateFileName="AAFOID~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2ef70d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2ef70d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2ef70d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2e3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAkhMz9[2].png.crypt", cAlternateFileName="AAKHMZ~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2ef70d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2ef70d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2f1d230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAmRY2Q[1].png.crypt", cAlternateFileName="AAMRY2~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2f1d230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2f1d230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2f1d230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAni8qk[1].png.crypt", cAlternateFileName="AANI8Q~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf1239b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf1239b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf1239b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7a52, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="adition[1].js", cAlternateFileName="ADITIO~1.JS")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53c4a830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="async_usersync[1].htm", cAlternateFileName="ASYNC_~1.HTM")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2f1d230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2f1d230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2f43390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5feb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.crypt", cAlternateFileName="B367C0~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2f43390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2f43390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2f43390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BB8jcOr[2].png.crypt", cAlternateFileName="BB8JCO~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2f43390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2f43390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2f694f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1c22, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBB8ZbM[1].jpg.crypt", cAlternateFileName="BBB8ZB~1.CRY")) returned 1 [0040.655] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2f694f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2f694f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2f694f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBB9wH0[1].png.crypt", cAlternateFileName="BBB9WH~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2f694f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2f694f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2f694f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2ac7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBCFjo[1].jpg.crypt", cAlternateFileName="BBBCFJ~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2f694f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2f694f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2f8f650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7c9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBDtcM[1].jpg.crypt", cAlternateFileName="BBBDTC~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2fb57b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2fb57b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2fb57b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f19, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBIeNJ[1].jpg.crypt", cAlternateFileName="BBBIEN~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2fb57b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2fb57b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2fb57b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x711, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBImKX[1].jpg.crypt", cAlternateFileName="BBBIMK~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2fdb910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2fdb910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2fdb910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2569, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBL4R9[1].jpg.crypt", cAlternateFileName="BBBL4R~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2fdb910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa2fdb910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa2fdb910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBLhTZ[1].jpg.crypt", cAlternateFileName="BBBLHT~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3001a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3001a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3001a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9b9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBnhZY[1].jpg.crypt", cAlternateFileName="BBBNHZ~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3001a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3001a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3001a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x48f4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBPhAr[1].jpg.crypt", cAlternateFileName="BBBPHA~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3001a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3001a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3027bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1c21, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBPiby[1].jpg.crypt", cAlternateFileName="BBBPIB~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3027bd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3027bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3027bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x16bf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBPmXJ[1].jpg.crypt", cAlternateFileName="BBBPMX~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3027bd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3027bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa304dd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x21feb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBPS37[1].png.crypt", cAlternateFileName="BBBPS3~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3073e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3073e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3099ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x12f9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBQiBF[1].jpg.crypt", cAlternateFileName="BBBQIB~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3099ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3099ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3099ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9a9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBty8h[1].jpg.crypt", cAlternateFileName="BBBTY8~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3099ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3099ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa30c0150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBVACL[1].jpg.crypt", cAlternateFileName="BBBVAC~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa30c0150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa30c0150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa30c0150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1c41, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBVGyR[1].jpg.crypt", cAlternateFileName="BBBVGY~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa30c0150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa30c0150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa30c0150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBVMtX[1].jpg.crypt", cAlternateFileName="BBBVMT~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa30e62b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa30e62b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa30e62b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBVYsu[1].jpg.crypt", cAlternateFileName="BBBVYS~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa30e62b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa30e62b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa310c410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x76a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBWLtW[1].jpg.crypt", cAlternateFileName="BBBWLT~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa310c410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa310c410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa310c410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBX3xB[1].jpg.crypt", cAlternateFileName="BBBX3X~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa310c410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa310c410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa310c410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x241e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBY98e[1].jpg.crypt", cAlternateFileName="BBBY98~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa310c410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa310c410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3132570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBZYVP[1].jpg.crypt", cAlternateFileName="BBBZYV~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3132570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3132570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3132570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x192a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC04o2[1].jpg.crypt", cAlternateFileName="BBC04O~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3132570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3132570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3216db0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x23fb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC04ok[1].jpg.crypt", cAlternateFileName="BBC04O~2.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3216db0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3216db0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa323cf10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2a99, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC04we[1].jpg.crypt", cAlternateFileName="BBC04W~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa323cf10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa323cf10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa323cf10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3200, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC05rl[1].jpg.crypt", cAlternateFileName="BBC05R~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa323cf10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa323cf10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3263070, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC05rl[2].jpg.crypt", cAlternateFileName="BBC05R~2.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3263070, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3263070, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3263070, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1b4e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0ATj[1].jpg.crypt", cAlternateFileName="BBC0AT~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3263070, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3263070, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa32891d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x751, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0D8i[1].jpg.crypt", cAlternateFileName="BBC0D8~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa32891d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa32891d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa32891d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0g7a[1].jpg.crypt", cAlternateFileName="BBC0G7~1.CRY")) returned 1 [0040.656] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa32891d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa32891d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa32af330, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0w1b[1].jpg.crypt", cAlternateFileName="BBC0W1~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa32af330, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa32af330, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa32af330, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x23ba, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0xLt[1].jpg.crypt", cAlternateFileName="BBC0XL~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa32af330, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa32af330, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa32af330, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb58, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBDWA22[1].jpg.crypt", cAlternateFileName="BBDWA2~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa32d5490, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa32d5490, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa32d5490, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x91d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBE7d3b[1].jpg.crypt", cAlternateFileName="BBE7D3~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa32d5490, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa32d5490, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa32fb5f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2850, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBE85ld[1].jpg.crypt", cAlternateFileName="BBE85L~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa32fb5f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa32fb5f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa32fb5f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x16ca, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEdckp[1].jpg.crypt", cAlternateFileName="BBEDCK~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa32fb5f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa32fb5f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa32fb5f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xafe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEdMci[1].jpg.crypt", cAlternateFileName="BBEDMC~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa32fb5f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa32fb5f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3321750, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2a48, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEdSLV[1].jpg.crypt", cAlternateFileName="BBEDSL~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3321750, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3321750, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3321750, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x87f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEe2Pd[1].jpg.crypt", cAlternateFileName="BBEE2P~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3321750, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3321750, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa33478b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3faf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEe4Oo[1].png.crypt", cAlternateFileName="BBEE4O~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33478b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa33478b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa33478b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xaa9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEe6Ew[1].jpg.crypt", cAlternateFileName="BBEE6E~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33478b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa33478b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa33478b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1d26, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeFp3[1].jpg.crypt", cAlternateFileName="BBEEFP~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33478b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa33478b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa336da10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeGwU[1].jpg.crypt", cAlternateFileName="BBEEGW~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa336da10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa336da10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa336da10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7be, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeUg0[1].jpg.crypt", cAlternateFileName="BBEEUG~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa336da10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa336da10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3393b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3a2a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeZnr[1].jpg.crypt", cAlternateFileName="BBEEZN~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3393b70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3393b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3393b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2f76, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEf5Lq[1].jpg.crypt", cAlternateFileName="BBEF5L~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3393b70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3393b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa33b9cd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfwtU[1].jpg.crypt", cAlternateFileName="BBEFWT~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33b9cd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa33b9cd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa33b9cd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfzSd[1].jpg.crypt", cAlternateFileName="BBEFZS~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33b9cd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa33b9cd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa33dfe30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgCuQ[1].jpg.crypt", cAlternateFileName="BBEGCU~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33dfe30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa33dfe30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa33dfe30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1a65, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgHzB[1].jpg.crypt", cAlternateFileName="BBEGHZ~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa33dfe30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa33dfe30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa33dfe30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5a45, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgIl2[1].jpg.crypt", cAlternateFileName="BBEGIL~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3405f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3405f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3405f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x388f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgIl2[2].jpg.crypt", cAlternateFileName="BBEGIL~2.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3405f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3405f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3405f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1e97, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgIyL[1].jpg.crypt", cAlternateFileName="BBEGIY~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa342c0f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa342c0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa342c0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x23bf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgkY6[1].jpg.crypt", cAlternateFileName="BBEGKY~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa342c0f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa342c0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa342c0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8df, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgLzV[1].jpg.crypt", cAlternateFileName="BBEGLZ~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa342c0f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa342c0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3452250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2b8d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgUri[1].jpg.crypt", cAlternateFileName="BBEGUR~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3452250, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3452250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3452250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x201f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgXBv[1].jpg.crypt", cAlternateFileName="BBEGXB~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3452250, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3452250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa34783b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6e9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgZME[1].jpg.crypt", cAlternateFileName="BBEGZM~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa34783b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa34783b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa34783b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBghfVy[1].png.crypt", cAlternateFileName="BBGHFV~1.CRY")) returned 1 [0040.657] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa34783b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa34783b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa34783b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBkwUr[1].png.crypt", cAlternateFileName="BBKWUR~1.CRY")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa34783b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa34783b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa349e510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBlBV0U[1].png.crypt", cAlternateFileName="BBLBV0~1.CRY")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa349e510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa349e510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa349e510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3376, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBzhWWE[1].jpg.crypt", cAlternateFileName="BBZHWW~1.CRY")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa34c4670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa34c4670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa34c4670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13c06, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="benefits-2[1].jpg.crypt", cAlternateFileName="BENEFI~1.CRY")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa34c4670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa34c4670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa34ea7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x144cd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="benefits-4[1].jpg.crypt", cAlternateFileName="BENEFI~2.CRY")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf4dbc10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf4dbc10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf4dbc10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6f15, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="bootstrap[1].js", cAlternateFileName="BOOTST~1.JS")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x583e0320, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x583e0320, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x583e0320, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="browser[1].htm", cAlternateFileName="BROWSE~1.HTM")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b2b1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b2b1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b2b1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4dd8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="bs-jsdep[1].css", cAlternateFileName="BS-JSD~1.CSS")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61341460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61341460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x613675c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c9f6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x467cf930, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29349, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="core[1].css", cAlternateFileName="CORE_1~1.CSS")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa34ea7d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa34ea7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3510930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54ca7f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54ca7f70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54ca7f70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a3c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="DevCMDL2.2.18[1].eot", cAlternateFileName="DEVCMD~1.EOT")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5120a1b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5120a1b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5120a1b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="e151e5[1].gif", cAlternateFileName="E151E5~1.GIF")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3510930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3510930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3536a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x24e29, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="e4-190963-91cdfbc1[1].txt.crypt", cAlternateFileName="E4-190~1.CRY")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60b5eb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60b5eb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60f89200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf8f5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="eula_text[1].htm", cAlternateFileName="EULA_T~1.HTM")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3536a90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3536a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa355cbf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x34ce, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="f[1].txt.crypt", cAlternateFileName="F_1_TX~1.CRY")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53089b90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53089b90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53089b90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1254, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa355cbf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa355cbf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa355cbf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="google_plus_16dp[1].png.crypt", cAlternateFileName="GOOGLE~1.CRY")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b80810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b80810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b80810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de2e5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5de2e5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5de54720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb6c8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index[1].htm", cAlternateFileName="INDEX_~1.HTM")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa355cbf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa355cbf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa355cbf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="print[1].txt.crypt", cAlternateFileName="PRINT_~1.CRY")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44f697b0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44f697b0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44f8f910, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x15429, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Standard[1]", cAlternateFileName="STANDA~1")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3582d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3582d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3582d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="tecjslog[1].png.crypt", cAlternateFileName="TECJSL~1.CRY")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x548efd10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x548efd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x548efd10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102ea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="uhf-main.var.min[1].js", cAlternateFileName="UHF-MA~1.JS")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2dd5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5386c470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5386c470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5386c470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d29, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="v2[2]", cAlternateFileName="V2_2_~1")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe751ef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe751ef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe751ef0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2fa8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="v2[3]", cAlternateFileName="V2_3_~1")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8829f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8829f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8829f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="v2[4]", cAlternateFileName="V2_4_~1")) returned 1 [0040.658] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8829f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8829f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8829f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2da9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="v2[4]", cAlternateFileName="V2_4_~1")) returned 0 [0040.658] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.659] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3582d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3582d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3582d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x696d2e72, dwReserved1=0x5d315b6e, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.659] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b5a6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x696d2e72, dwReserved1=0x5d315b6e, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.659] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa3b2a190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3b2a190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696d2e72, dwReserved1=0x5d315b6e, cFileName="IKQEEPZR", cAlternateFileName="")) returned 1 [0040.659] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.659] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.659] CryptHashData (hHash=0x5c91c0, pbData=0x33e2058, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.659] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9100) returned 1 [0040.659] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0040.659] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18e808) returned 0 [0040.659] GetLastError () returned 0xea [0040.659] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.660] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.660] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.661] SetEndOfFile (hFile=0x104) returned 1 [0040.661] CloseHandle (hObject=0x104) returned 1 [0040.661] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.661] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.661] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8b80810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b80810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.661] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8b80810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b80810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.661] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45027e90, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45027e90, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45027e90, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xa756, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="19619569[1].gif", cAlternateFileName="196195~1.GIF")) returned 1 [0040.661] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54962130, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54962130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x549ae3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x461fe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7962161087[1].js", cAlternateFileName="796216~1.JS")) returned 1 [0040.661] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3582d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3582d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa35a8eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA3DGHW[1].png.crypt", cAlternateFileName="AA3DGH~1.CRY")) returned 1 [0040.661] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa35a8eb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa35a8eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa35a8eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA3e1pt[2].png.crypt", cAlternateFileName="AA3E1P~1.CRY")) returned 1 [0040.661] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa35a8eb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa35a8eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa35a8eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA42ckd[1].png.crypt", cAlternateFileName="AA42CK~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa35cf010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa35cf010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa35cf010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA42eYr[1].png.crypt", cAlternateFileName="AA42EY~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa35cf010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa35cf010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa35cf010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA61ILp[2].png.crypt", cAlternateFileName="AA61IL~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa35cf010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa35cf010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa35cf010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA6SNZ6[1].png.crypt", cAlternateFileName="AA6SNZ~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa35f5170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa35f5170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa35f5170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAbyinC[1].png.crypt", cAlternateFileName="AABYIN~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa35f5170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa35f5170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa35f5170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x340b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAicW5W[1].jpg.crypt", cAlternateFileName="AAICW5~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa361b2d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa361b2d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa361b2d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAj0doQ[1].jpg.crypt", cAlternateFileName="AAJ0DO~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa361b2d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa361b2d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa361b2d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAkqhIf[1].png.crypt", cAlternateFileName="AAKQHI~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa361b2d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa361b2d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3641430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x278e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAmo09p[1].jpg.crypt", cAlternateFileName="AAMO09~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3641430, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3641430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3641430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAmUyV2[1].png.crypt", cAlternateFileName="AAMUYV~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3641430, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3641430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3641430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAn7gKR[1].png.crypt", cAlternateFileName="AAN7GK~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61be2420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61be2420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61be2420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x650, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="activityi;src=2542116;type=clien612;cat=chrom0;ord=1;num=7814394060213[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2a0770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2a0770, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf54e030, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0xf1f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="adfserve[1]", cAlternateFileName="ADFSER~1")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x533a9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x533a9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x533a9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11835, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ast[2].js", cAlternateFileName="AST_2_~1.JS")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53d7b330, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53d7b330, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53d7b330, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="async_usersync[1]", cAlternateFileName="ASYNC_~1")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5108d3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5108d3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x86e6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="b2fd15[1].eot", cAlternateFileName="B2FD15~1.EOT")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3667590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3667590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3667590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BB5zDwX[1].png.crypt", cAlternateFileName="BB5ZDW~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3667590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3667590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3667590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBaK3Nm[1].png.crypt", cAlternateFileName="BBAK3N~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3667590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3667590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa368d6f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2143, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBLcCz[1].jpg.crypt", cAlternateFileName="BBBLCC~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa368d6f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa368d6f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa368d6f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x912, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBLdzQ[1].jpg.crypt", cAlternateFileName="BBBLDZ~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa368d6f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa368d6f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa36b3850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBO1mQ[1].jpg.crypt", cAlternateFileName="BBBO1M~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa36b3850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa36b3850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa36b3850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x36d2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBO1qB[1].jpg.crypt", cAlternateFileName="BBBO1Q~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa36b3850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa36b3850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa36b3850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBOIAt[1].jpg.crypt", cAlternateFileName="BBBOIA~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa36b3850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa36b3850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa36d99b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBOmuh[1].jpg.crypt", cAlternateFileName="BBBOMU~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa36d99b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa36d99b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa36d99b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBPK5J[1].jpg.crypt", cAlternateFileName="BBBPK5~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa36ffb10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa36ffb10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa36ffb10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBPMvJ[1].jpg.crypt", cAlternateFileName="BBBPMV~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa36ffb10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa36ffb10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3725c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBUL3E[1].jpg.crypt", cAlternateFileName="BBBUL3~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3725c70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3725c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3725c70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBUqkT[1].jpg.crypt", cAlternateFileName="BBBUQK~1.CRY")) returned 1 [0040.662] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3725c70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3725c70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa374bdd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBUqkT[2].jpg.crypt", cAlternateFileName="BBBUQK~2.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa374bdd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa374bdd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa374bdd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBX3z0[1].jpg.crypt", cAlternateFileName="BBBX3Z~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa374bdd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa374bdd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa374bdd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x22b3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBYEW1[1].jpg.crypt", cAlternateFileName="BBBYEW~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3771f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3771f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3771f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBYfEH[1].jpg.crypt", cAlternateFileName="BBBYFE~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3771f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3771f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3771f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2ca1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBZ20W[1].jpg.crypt", cAlternateFileName="BBBZ20~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3798090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3798090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3798090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f37, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBzaxY[1].jpg.crypt", cAlternateFileName="BBBZAX~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3798090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3798090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3798090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2131, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBZzuz[1].jpg.crypt", cAlternateFileName="BBBZZU~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa37be1f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa37be1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa37be1f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x370a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC03B1[1].jpg.crypt", cAlternateFileName="BBC03B~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa37be1f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa37be1f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa37e4350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC04o2[1].jpg.crypt", cAlternateFileName="BBC04O~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa37e4350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa37e4350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa37e4350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2036, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC06ZQ[1].jpg.crypt", cAlternateFileName="BBC06Z~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa37e4350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa37e4350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa37e4350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13fd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0ALC[1].jpg.crypt", cAlternateFileName="BBC0AL~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa380a4b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa380a4b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa380a4b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0BiZ[1].jpg.crypt", cAlternateFileName="BBC0BI~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa380a4b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa380a4b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa380a4b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0FXU[1].jpg.crypt", cAlternateFileName="BBC0FX~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3830610, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3830610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3830610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2fd1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0FXU[2].jpg.crypt", cAlternateFileName="BBC0FX~2.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3830610, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3830610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3856770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x29c3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0mkg[1].jpg.crypt", cAlternateFileName="BBC0MK~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3856770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3856770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3856770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa7b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0mkg[2].jpg.crypt", cAlternateFileName="BBC0MK~2.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3856770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3856770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa387c8d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x17af, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0oQi[1].jpg.crypt", cAlternateFileName="BBC0OQ~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa387c8d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa387c8d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa387c8d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xaf3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0tCi[1].jpg.crypt", cAlternateFileName="BBC0TC~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa387c8d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa387c8d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa387c8d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x350a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBCM2U2[1].jpg.crypt", cAlternateFileName="BBCM2U~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38a2a30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa38a2a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa38a2a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBDGTbx[1].jpg.crypt", cAlternateFileName="BBDGTB~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38a2a30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa38a2a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa38a2a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBDk44m[1].png.crypt", cAlternateFileName="BBDK44~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38a2a30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa38a2a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa38c8b90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2d04, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBDWXoC[1].jpg.crypt", cAlternateFileName="BBDWXO~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38c8b90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa38c8b90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa38c8b90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBE3NcH[1].jpg.crypt", cAlternateFileName="BBE3NC~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38c8b90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa38c8b90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa38c8b90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBE7GLE[1].png.crypt", cAlternateFileName="BBE7GL~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38c8b90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa38c8b90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa38eecf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1c9b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBE8aLO[1].jpg.crypt", cAlternateFileName="BBE8AL~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38eecf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa38eecf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3914e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x702, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEd5bF[1].jpg.crypt", cAlternateFileName="BBED5B~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3914e50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3914e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa393afb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xaca8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEdDNm[1].jpg.crypt", cAlternateFileName="BBEDDN~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa393afb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa393afb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa393afb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEdpyr[1].jpg.crypt", cAlternateFileName="BBEDPY~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa393afb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa393afb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3961110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1c72, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEdQdv[1].jpg.crypt", cAlternateFileName="BBEDQD~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3961110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3961110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3961110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa23, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEe62t[1].jpg.crypt", cAlternateFileName="BBEE62~1.CRY")) returned 1 [0040.663] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3961110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3961110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3987270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1ca7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEedPR[1].jpg.crypt", cAlternateFileName="BBEEDP~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3987270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3987270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3987270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeTpB[1].jpg.crypt", cAlternateFileName="BBEETP~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3987270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3987270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3987270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeTuf[1].jpg.crypt", cAlternateFileName="BBEETU~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3987270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3987270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa39ad3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeU5U[1].jpg.crypt", cAlternateFileName="BBEEU5~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa39ad3d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa39ad3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa39ad3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x86f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEf306[1].jpg.crypt", cAlternateFileName="BBEF30~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa39ad3d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa39ad3d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa39d3530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEf54R[1].jpg.crypt", cAlternateFileName="BBEF54~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa39d3530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa39d3530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa39d3530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3860, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfBbH[1].jpg.crypt", cAlternateFileName="BBEFBB~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa39d3530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa39d3530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa39d3530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x19a5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfBq0[1].jpg.crypt", cAlternateFileName="BBEFBQ~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa39f9690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa39f9690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa39f9690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2619, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfBrz[1].jpg.crypt", cAlternateFileName="BBEFBR~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa39f9690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa39f9690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa39f9690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f84, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfXl6[1].jpg.crypt", cAlternateFileName="BBEFXL~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa39f9690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa39f9690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3a1f7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1c7e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgEH3[1].jpg.crypt", cAlternateFileName="BBEGEH~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3a1f7f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3a1f7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3a1f7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8f9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgsz3[1].jpg.crypt", cAlternateFileName="BBEGSZ~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3a1f7f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3a1f7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3a1f7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9b7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgTxB[1].jpg.crypt", cAlternateFileName="BBEGTX~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3a6bab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3a6bab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3a6bab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x36e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBo1lFJ[2].png.crypt", cAlternateFileName="BBO1LF~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3a6bab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3a6bab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3a91c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBs47TE[1].png.crypt", cAlternateFileName="BBS47T~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3a91c10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3a91c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3a91c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2cb0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBu9sWQ[1].jpg.crypt", cAlternateFileName="BBU9SW~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3a91c10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3a91c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3ab7d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BByazif[2].jpg.crypt", cAlternateFileName="BBYAZI~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b51310, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b51310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b51310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xaf13, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="bs-components[1].css", cAlternateFileName="BS-COM~1.CSS")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30be, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="bs-util[1].css", cAlternateFileName="BS-UTI~1.CSS")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3ab7d70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3ab7d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3added0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x254f1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="c7-bdbd0d-91cdfbc1[1].txt.crypt", cAlternateFileName="C7-BDB~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x614e4380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x614e4380, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x614e4380, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x211dd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cb=gapi[1].loaded_0", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63c04d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c04d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x63c04d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x653e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cb=gapi[2].loaded_0", cAlternateFileName="CB_GAP~2.LOA")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x584c4b60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x584c4b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58510e20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a03f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="chrome.min[1].css", cAlternateFileName="CHROME~1.CSS")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c69520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c69520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c69520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="chrome_throbber_fast_16[1].gif", cAlternateFileName="CHROME~1.GIF")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x55333bf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x55333bf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55333bf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="collect[1].gif", cAlternateFileName="COLLEC~1.GIF")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe8f4e10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe8f4e10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe8f4e10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x7b1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ContainerTag[1].js", cAlternateFileName="CONTAI~1.JS")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3added0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3added0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3added0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3added0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3added0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3b04030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x48ba, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="eula-mac[1].jpg.crypt", cAlternateFileName="EULA-M~1.CRY")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x61093ba0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa84a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ga[1].js", cAlternateFileName="GA_1_~1.JS")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe1f6d70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1305, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~1")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x659c6020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x659c6020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65c99a40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="GoogleInstaller_de[1].application", cAlternateFileName="GOOGLE~1.APP")) returned 1 [0040.664] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b80810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b80810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b80810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf03f170, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf03f170, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf0652d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4c9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2544b0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2544b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf2544b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54feddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54feddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x550601d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7a43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54d1a390, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a114, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MemMDL2.2.17[1].eot", cAlternateFileName="MEMMDL~1.EOT")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605b7740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605b7740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605b7740, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46c9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="modernizr[1].js", cAlternateFileName="MODERN~1.JS")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x457e4610, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x457e4610, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x457e4610, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0xec5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSNIdSync[1].js", cAlternateFileName="MSNIDS~1.JS")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfbb3b50, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfbb3b50, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbfbb3b50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="only[1].htm", cAlternateFileName="ONLY_1~1.HTM")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x456d9c70, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x6b6d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="player[1].js", cAlternateFileName="PLAYER~1.JS")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x456d9c70, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x456d9c70, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45856a30, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x5f44, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="player[2].js", cAlternateFileName="PLAYER~2.JS")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b04030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3b04030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3b04030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="tecjslog[1].png.crypt", cAlternateFileName="TECJSL~1.CRY")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x692027e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x692027e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69232580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x805a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thankyou[1].htm", cAlternateFileName="THANKY~1.HTM")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b2a190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3b2a190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3b2a190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="th[1].jpg.crypt", cAlternateFileName="TH_1_J~1.CRY")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b2a190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3b2a190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3b2a190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x911, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="th[1].jpg.crypt", cAlternateFileName="TH_1_J~1.CRY")) returned 0 [0040.665] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x74707972, dwReserved1=0x7972632e, cFileName="index.dat", cAlternateFileName="")) returned 1 [0040.665] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa4085310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4085310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74707972, dwReserved1=0x7972632e, cFileName="YG1R61Z8", cAlternateFileName="")) returned 1 [0040.665] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.666] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.666] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.666] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c91c0) returned 1 [0040.666] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.666] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18e808) returned 0 [0040.666] GetLastError () returned 0xea [0040.666] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.666] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.667] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.668] SetEndOfFile (hFile=0x104) returned 1 [0040.668] CloseHandle (hObject=0x104) returned 1 [0040.668] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.668] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.668] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8ba6970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ba6970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8ba6970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ba6970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b2a190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3b2a190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3b502f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7f7e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0ff92924-f857-491e-a2ee-c0fe20f0d064[1].jpg.crypt", cAlternateFileName="0FF929~1.CRY")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b502f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3b502f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3b502f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xc05f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="26158[1].png.crypt", cAlternateFileName="26158_~1.CRY")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b76450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3b76450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3b76450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA42x3V[1].png.crypt", cAlternateFileName="AA42X3~1.CRY")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b76450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3b76450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3b76450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA58NQj[1].png.crypt", cAlternateFileName="AA58NQ~1.CRY")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b76450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3b76450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3b76450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA61Ofl[1].png.crypt", cAlternateFileName="AA61OF~1.CRY")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b9c5b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3b9c5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3b9c5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AA6SFRQ[2].png.crypt", cAlternateFileName="AA6SFR~1.CRY")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b9c5b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3b9c5b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3b9c5b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAa1vhm[1].png.crypt", cAlternateFileName="AAA1VH~1.CRY")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3bc2710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3bc2710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3bc2710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAa1xJF[1].png.crypt", cAlternateFileName="AAA1XJ~1.CRY")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3bc2710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3bc2710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3bc2710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAlG41q[1].jpg.crypt", cAlternateFileName="AALG41~1.CRY")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3bc2710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3bc2710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3bc2710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAmin0Z[1].png.crypt", cAlternateFileName="AAMIN0~1.CRY")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3be8870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3be8870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3be8870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x36b1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AAnhRyj[1].jpg.crypt", cAlternateFileName="AANHRY~1.CRY")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c161a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64c161a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64e9d900, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="activityi;src=2542116;cat=Chrom00;type=clien612;ord=2366422437621[1].htm", cAlternateFileName="ACTIVI~1.HTM")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2eca30, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf2eca30, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x91dd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="adex[1].js", cAlternateFileName="ADEX_1~1.JS")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x540e72d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540e72d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x540e72d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="adfscript[1]", cAlternateFileName="ADFSCR~1")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdb6b0f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdb6b0f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbdb6b0f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x525b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="adsWrapperMSNI[1].js", cAlternateFileName="ADSWRA~1.JS")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3be8870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3be8870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3be8870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8217, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ae8e984b-1820-4a8d-93dc-392ed6563fb6[1].jpg.crypt", cAlternateFileName="AE8E98~1.CRY")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe112530, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe112530, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1183b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ast[1].js", cAlternateFileName="AST_1_~1.JS")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58798580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58798580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58798580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="autotrack[1].js", cAlternateFileName="AUTOTR~1.JS")) returned 1 [0040.668] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3c0e9d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3c0e9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3c0e9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BB56XTo[1].png.crypt", cAlternateFileName="BB56XT~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3c0e9d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3c0e9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3c0e9d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1b6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BB5vO0g[1].png.crypt", cAlternateFileName="BB5VO0~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3c0e9d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3c0e9d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3c34b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BB8AdqN[1].png.crypt", cAlternateFileName="BB8ADQ~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3c34b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3c34b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3c34b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x152c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBALZyp[1].jpg.crypt", cAlternateFileName="BBALZY~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3c34b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3c34b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3c34b30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x97c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBImKp[1].jpg.crypt", cAlternateFileName="BBBIMK~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3c34b30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3c34b30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3c5ac90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x29ca, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBMGJo[1].jpg.crypt", cAlternateFileName="BBBMGJ~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3c5ac90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3c5ac90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3c5ac90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x862, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBMKDF[1].jpg.crypt", cAlternateFileName="BBBMKD~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3c5ac90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3c5ac90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3c5ac90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBMQch[1].jpg.crypt", cAlternateFileName="BBBMQC~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3c80df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3c80df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3c80df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3e6b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBMyVh[1].jpg.crypt", cAlternateFileName="BBBMYV~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3c80df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3c80df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3c80df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBNAf7[1].jpg.crypt", cAlternateFileName="BBBNAF~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3ca6f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3ca6f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3ca6f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBNnTF[1].jpg.crypt", cAlternateFileName="BBBNNT~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3ca6f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3ca6f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3ca6f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1529, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBO4dZ[1].jpg.crypt", cAlternateFileName="BBBO4D~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3ca6f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3ca6f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3ccd0b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1e61, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBO8ow[1].jpg.crypt", cAlternateFileName="BBBO8O~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3ccd0b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3ccd0b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3ccd0b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBOaeS[1].jpg.crypt", cAlternateFileName="BBBOAE~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3ccd0b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3ccd0b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3ccd0b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBOcIb[1].jpg.crypt", cAlternateFileName="BBBOCI~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3cf3210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3cf3210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3cf3210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBOddp[1].jpg.crypt", cAlternateFileName="BBBODD~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3cf3210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3cf3210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3cf3210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5685, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBOmar[1].jpg.crypt", cAlternateFileName="BBBOMA~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3d19370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3d19370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3d19370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2f6b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBR4yQ[1].jpg.crypt", cAlternateFileName="BBBR4Y~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3d19370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3d19370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3d19370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBUPaj[1].jpg.crypt", cAlternateFileName="BBBUPA~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3d3f4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3d3f4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3d3f4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3e08, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBVEOW[1].jpg.crypt", cAlternateFileName="BBBVEO~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3d3f4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3d3f4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3d3f4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa1f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBVLcG[1].jpg.crypt", cAlternateFileName="BBBVLC~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3d3f4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3d3f4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3d65630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x82d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBVSkP[1].jpg.crypt", cAlternateFileName="BBBVSK~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3d65630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3d65630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3d65630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x16f5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBYfEH[1].jpg.crypt", cAlternateFileName="BBBYFE~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3d65630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3d65630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3d65630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBBZ5vT[1].jpg.crypt", cAlternateFileName="BBBZ5V~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3d8b790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3d8b790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3d8b790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC02Gr[1].jpg.crypt", cAlternateFileName="BBC02G~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3d8b790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3d8b790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3d8b790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC02Gr[2].jpg.crypt", cAlternateFileName="BBC02G~2.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3d8b790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3d8b790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3db18f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x89a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC03B1[1].jpg.crypt", cAlternateFileName="BBC03B~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3db18f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3db18f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3db18f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7bb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC06Ub[1].jpg.crypt", cAlternateFileName="BBC06U~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3db18f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3db18f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3db18f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0Djg[1].jpg.crypt", cAlternateFileName="BBC0DJ~1.CRY")) returned 1 [0040.669] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3dd7a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3dd7a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3dd7a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7fd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0g7a[1].jpg.crypt", cAlternateFileName="BBC0G7~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3dd7a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3dd7a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3dd7a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x82f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0lf2[1].jpg.crypt", cAlternateFileName="BBC0LF~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3dd7a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3dd7a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3dfdbb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1afe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0mK1[1].jpg.crypt", cAlternateFileName="BBC0MK~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3dfdbb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3dfdbb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3dfdbb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1fc3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBC0qlB[1].jpg.crypt", cAlternateFileName="BBC0QL~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3dfdbb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3dfdbb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3e23d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2ecb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBE7KPZ[1].jpg.crypt", cAlternateFileName="BBE7KP~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3e23d10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3e23d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3e23d10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBE8IlA[1].jpg.crypt", cAlternateFileName="BBE8IL~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3e23d10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3e23d10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3e49e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2669, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBE972F[1].jpg.crypt", cAlternateFileName="BBE972~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3e49e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3e49e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3e49e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2a77, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBE9tdx[1].jpg.crypt", cAlternateFileName="BBE9TD~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3e49e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3e49e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3e6ffd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2fe3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEdrqt[1].jpg.crypt", cAlternateFileName="BBEDRQ~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3e6ffd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3e6ffd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3e6ffd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x857, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeEwt[1].jpg.crypt", cAlternateFileName="BBEEEW~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3e6ffd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3e6ffd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3e6ffd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7d9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeis3[1].jpg.crypt", cAlternateFileName="BBEEIS~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3e6ffd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3e6ffd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3e96130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeKvV[1].jpg.crypt", cAlternateFileName="BBEEKV~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3e96130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3e96130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3e96130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xef00, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeNd8[1].png.crypt", cAlternateFileName="BBEEND~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3e96130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3e96130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3ebc290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3323, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEewZB[1].jpg.crypt", cAlternateFileName="BBEEWZ~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3ebc290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3ebc290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3ebc290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9d7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEeZ0k[1].jpg.crypt", cAlternateFileName="BBEEZ0~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3ee23f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3ee23f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3ee23f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2d32, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEf6s4[1].jpg.crypt", cAlternateFileName="BBEF6S~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3ee23f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3ee23f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3ee23f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x85d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfAc5[1].jpg.crypt", cAlternateFileName="BBEFAC~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3ee23f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3ee23f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3f08550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x197c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfgDi[1].jpg.crypt", cAlternateFileName="BBEFGD~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3f08550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3f08550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3f08550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb7e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfjuT[1].jpg.crypt", cAlternateFileName="BBEFJU~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3f08550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3f08550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3f08550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1b14, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfkgi[1].jpg.crypt", cAlternateFileName="BBEFKG~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3f2e6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3f2e6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3f2e6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2978, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfRKA[1].jpg.crypt", cAlternateFileName="BBEFRK~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3f2e6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3f2e6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3f2e6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfRwv[1].jpg.crypt", cAlternateFileName="BBEFRW~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3f2e6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3f2e6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3f54810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2676, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfwtU[1].jpg.crypt", cAlternateFileName="BBEFWT~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3f54810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3f54810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3f54810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb41, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEfY4X[1].jpg.crypt", cAlternateFileName="BBEFY4~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3f54810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3f54810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3f7a970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x25f6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgD9f[1].jpg.crypt", cAlternateFileName="BBEGD9~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3f7a970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3f7a970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3f7a970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x819, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgJfz[1].jpg.crypt", cAlternateFileName="BBEGJF~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3f7a970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3f7a970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3f7a970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x916, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgsWA[1].jpg.crypt", cAlternateFileName="BBEGSW~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3f7a970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3f7a970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3fa0ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBEgX5G[1].jpg.crypt", cAlternateFileName="BBEGX5~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3fa0ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3fa0ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3fa0ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBih5H[1].png.crypt", cAlternateFileName="BBIH5H~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3fa0ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3fa0ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3fa0ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBmUxRK[1].png.crypt", cAlternateFileName="BBMUXR~1.CRY")) returned 1 [0040.670] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3fc6c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3fc6c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3fc6c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x398, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBndhJA[1].png.crypt", cAlternateFileName="BBNDHJ~1.CRY")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3fc6c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3fc6c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3fc6c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBoqF0J[1].png.crypt", cAlternateFileName="BBOQF0~1.CRY")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3fc6c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3fc6c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa3fecd90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BBzjV9E[1].png.crypt", cAlternateFileName="BBZJV9~1.CRY")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3fecd90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa3fecd90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4012ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1fdaf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="benefits-1[1].jpg.crypt", cAlternateFileName="BENEFI~1.CRY")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6157c900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6157c900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x615c8bc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x12282, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cb=gapi[1].loaded_1", cAlternateFileName="CB_GAP~1.LOA")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50fa0830, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x82d8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="chartbeat[1].js", cAlternateFileName="CHARTB~1.JS")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x60c8f680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x60c8f680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d01aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3bf20, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="chrome-installer.min[1].js", cAlternateFileName="CHROME~1.JS")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4012ef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4012ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4012ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="chrome_logo_2x[1].png.crypt", cAlternateFileName="CHROME~1.CRY")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4012ef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4012ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4012ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="close-icon[1].png.crypt", cAlternateFileName="CLOSE-~1.CRY")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4039050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4039050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa405f1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x269b2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="css[1].txt.crypt", cAlternateFileName="CSS_1_~1.CRY")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa405f1b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa405f1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa405f1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf7af630, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7af630, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf821a50, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x4d5b9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ebHtml5Banner[1].js", cAlternateFileName="EBHTML~1.JS")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4085310, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4085310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4085310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5244, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="eula-win[1].jpg.crypt", cAlternateFileName="EULA-W~1.CRY")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe15e7f0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe15e7f0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe15e7f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1303, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~3")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x530afcf0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x530afcf0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x530afcf0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8c3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", cAlternateFileName="GETYPE~1")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe138690, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe138690, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe138690, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", cAlternateFileName="GETYPE~2")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ba6970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ba6970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ba6970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510ff810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510ff810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51125970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1762e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="jquery-1.11.1.min[1].js", cAlternateFileName="JQUERY~1.JS")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5442d110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5442d110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5442d110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="js[1]", cAlternateFileName="JS_1_~1")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x44bd95f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="js[2]", cAlternateFileName="JS_2_~1")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d66650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d66650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e70ff0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x7154, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="latest[1].eot", cAlternateFileName="LATEST~1.EOT")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x6e9b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="latest[2].eot", cAlternateFileName="LATEST~2.EOT")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54e97150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x77b3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="latest[3].eot", cAlternateFileName="LATEST~3.EOT")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52e4e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52e4e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x53122110, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x922, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="msn[1].htm", cAlternateFileName="MSN_1_~1.HTM")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6378e3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6378e3e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x637b4540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3112, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="rpc_shindig_random[1].js", cAlternateFileName="RPC_SH~1.JS")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0xbf7d5790, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7d5790, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thirdparty[1]", cAlternateFileName="THIRDP~1")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54a20810, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54a20810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54adeef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="uid[1].htm", cAlternateFileName="UID_1_~1.HTM")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbe5d5130, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbe5d5130, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x3325, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="v2[1]", cAlternateFileName="V2_1_~1")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 1 [0040.671] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54c35b50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54c35b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54c5bcb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x24fea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="wc-addons[1].css", cAlternateFileName="WC-ADD~1.CSS")) returned 0 [0040.671] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.672] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa4085310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4085310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74707972, dwReserved1=0x7972632e, cFileName="YG1R61Z8", cAlternateFileName="")) returned 0 [0040.672] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.672] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4085310, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4085310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4085310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.672] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8b5a6b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8b5a6b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8b5a6b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.672] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0040.672] FindNextFileA (in: hFindFile=0x5c9180, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0 [0040.672] FindClose (in: hFindFile=0x5c9180 | out: hFindFile=0x5c9180) returned 1 [0040.672] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20455254, dwReserved1=0x52434e45, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0040.672] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.672] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.672] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.672] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0040.672] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.673] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.673] GetLastError () returned 0xea [0040.673] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.673] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.674] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.675] SetEndOfFile (hFile=0x108) returned 1 [0040.675] CloseHandle (hObject=0x108) returned 1 [0040.675] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.675] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.675] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ba6970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ba6970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.675] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ba6970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ba6970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.675] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="C", cAlternateFileName="")) returned 1 [0040.675] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.676] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.676] CryptHashData (hHash=0x5c9180, pbData=0x1fc6440, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.676] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c91c0) returned 1 [0040.676] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.676] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ea70) returned 0 [0040.676] GetLastError () returned 0xea [0040.676] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.676] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.677] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.678] SetEndOfFile (hFile=0x114) returned 1 [0040.678] CloseHandle (hObject=0x114) returned 1 [0040.678] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.678] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.678] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8ba6970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ba6970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.678] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8ba6970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ba6970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.678] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ba6970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ba6970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.678] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Users", cAlternateFileName="")) returned 1 [0040.678] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.679] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.679] CryptHashData (hHash=0x5c9180, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.679] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9100) returned 1 [0040.679] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.679] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18e808) returned 0 [0040.679] GetLastError () returned 0xea [0040.679] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.679] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.680] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.681] SetEndOfFile (hFile=0x104) returned 1 [0040.681] CloseHandle (hObject=0x104) returned 1 [0040.681] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.681] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.681] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.681] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.682] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0040.682] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.682] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.682] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.682] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c90c0) returned 1 [0040.682] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.682] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18e5a0) returned 0 [0040.682] GetLastError () returned 0xea [0040.682] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.683] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.683] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.684] SetEndOfFile (hFile=0xfc) returned 1 [0040.684] CloseHandle (hObject=0xfc) returned 1 [0040.684] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.684] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.684] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.684] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.684] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AppData", cAlternateFileName="")) returned 1 [0040.684] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0040.685] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0040.685] CryptHashData (hHash=0x5c9180, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.685] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c9200) returned 1 [0040.685] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.685] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18e338) returned 0 [0040.685] GetLastError () returned 0xea [0040.685] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18e334*=0x260) returned 1 [0040.686] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\appdata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0040.686] WriteFile (in: hFile=0x100, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0040.687] SetEndOfFile (hFile=0x100) returned 1 [0040.687] CloseHandle (hObject=0x100) returned 1 [0040.687] CryptDestroyKey (hKey=0x5c9200) returned 1 [0040.687] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.687] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0040.687] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.687] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8bccad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.687] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Roaming", cAlternateFileName="")) returned 1 [0040.687] CryptAcquireContextA (in: phProv=0x18e0c4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e0c4*=0x5d0e80) returned 1 [0040.688] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e07c | out: phHash=0x18e07c) returned 1 [0040.688] CryptHashData (hHash=0x5c9180, pbData=0x1fc6440, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.688] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18e0c0 | out: phKey=0x18e0c0*=0x5c9080) returned 1 [0040.688] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.688] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e0d0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18e0d0) returned 0 [0040.688] GetLastError () returned 0xea [0040.688] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18e0cc*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18e0cc*=0x260) returned 1 [0040.688] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x10c [0040.689] WriteFile (in: hFile=0x10c, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18de50, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18de50*=0x7a0, lpOverlapped=0x0) returned 1 [0040.690] SetEndOfFile (hFile=0x10c) returned 1 [0040.690] CloseHandle (hObject=0x10c) returned 1 [0040.690] CryptDestroyKey (hKey=0x5c9080) returned 1 [0040.690] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.690] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0040.690] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.690] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8bccad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.690] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0040.690] CryptAcquireContextA (in: phProv=0x18de5c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18de5c*=0x5d0e80) returned 1 [0040.691] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18de14 | out: phHash=0x18de14) returned 1 [0040.691] CryptHashData (hHash=0x5c9180, pbData=0x1f63fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.691] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18de58 | out: phKey=0x18de58*=0x5c9240) returned 1 [0040.691] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.691] CryptEncrypt (in: hKey=0x5c9240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18de68*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18de68) returned 0 [0040.691] GetLastError () returned 0xea [0040.691] CryptEncrypt (in: hKey=0x5c9240, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18de64*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18de64*=0x260) returned 1 [0040.691] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0040.692] WriteFile (in: hFile=0x110, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18dbe8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18dbe8*=0x7a0, lpOverlapped=0x0) returned 1 [0040.693] SetEndOfFile (hFile=0x110) returned 1 [0040.693] CloseHandle (hObject=0x110) returned 1 [0040.693] CryptDestroyKey (hKey=0x5c9240) returned 1 [0040.693] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.693] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18de00 | out: lpFindFileData=0x18de00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9240 [0040.694] FindNextFileA (in: hFindFile=0x5c9240, lpFindFileData=0x18de00 | out: lpFindFileData=0x18de00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.694] FindNextFileA (in: hFindFile=0x5c9240, lpFindFileData=0x18de00 | out: lpFindFileData=0x18de00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8bccad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.694] FindNextFileA (in: hFindFile=0x5c9240, lpFindFileData=0x18de00 | out: lpFindFileData=0x18de00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows", cAlternateFileName="")) returned 1 [0040.694] CryptAcquireContextA (in: phProv=0x18dbf4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18dbf4*=0x5d0e80) returned 1 [0040.694] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18dbac | out: phHash=0x18dbac) returned 1 [0040.694] CryptHashData (hHash=0x5c9180, pbData=0x1fc6440, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.694] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18dbf0 | out: phKey=0x18dbf0*=0x5c9280) returned 1 [0040.694] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.694] CryptEncrypt (in: hKey=0x5c9280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18dc00*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18dc00) returned 0 [0040.694] GetLastError () returned 0xea [0040.694] CryptEncrypt (in: hKey=0x5c9280, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18dbfc*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18dbfc*=0x260) returned 1 [0040.695] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0040.695] WriteFile (in: hFile=0x118, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18d980, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18d980*=0x7a0, lpOverlapped=0x0) returned 1 [0040.696] SetEndOfFile (hFile=0x118) returned 1 [0040.696] CloseHandle (hObject=0x118) returned 1 [0040.696] CryptDestroyKey (hKey=0x5c9280) returned 1 [0040.696] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.697] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18db98 | out: lpFindFileData=0x18db98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9280 [0040.697] FindNextFileA (in: hFindFile=0x5c9280, lpFindFileData=0x18db98 | out: lpFindFileData=0x18db98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.697] FindNextFileA (in: hFindFile=0x5c9280, lpFindFileData=0x18db98 | out: lpFindFileData=0x18db98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8bf2c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.697] FindNextFileA (in: hFindFile=0x5c9280, lpFindFileData=0x18db98 | out: lpFindFileData=0x18db98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0040.697] CryptAcquireContextA (in: phProv=0x18d98c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18d98c*=0x5d0e80) returned 1 [0040.697] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18d944 | out: phHash=0x18d944) returned 1 [0040.697] CryptHashData (hHash=0x5c9180, pbData=0x1f65080, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.697] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18d988 | out: phKey=0x18d988*=0x5c92c0) returned 1 [0040.697] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.697] CryptEncrypt (in: hKey=0x5c92c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18d998*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18d998) returned 0 [0040.698] GetLastError () returned 0xea [0040.698] CryptEncrypt (in: hKey=0x5c92c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18d994*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18d994*=0x260) returned 1 [0040.698] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0040.698] WriteFile (in: hFile=0x11c, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18d718, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18d718*=0x7a0, lpOverlapped=0x0) returned 1 [0040.699] SetEndOfFile (hFile=0x11c) returned 1 [0040.699] CloseHandle (hObject=0x11c) returned 1 [0040.699] CryptDestroyKey (hKey=0x5c92c0) returned 1 [0040.699] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.700] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18d930 | out: lpFindFileData=0x18d930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c92c0 [0040.700] FindNextFileA (in: hFindFile=0x5c92c0, lpFindFileData=0x18d930 | out: lpFindFileData=0x18d930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.700] FindNextFileA (in: hFindFile=0x5c92c0, lpFindFileData=0x18d930 | out: lpFindFileData=0x18d930*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8bf2c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.700] FindNextFileA (in: hFindFile=0x5c92c0, lpFindFileData=0x18d930 | out: lpFindFileData=0x18d930*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 1 [0040.700] CryptAcquireContextA (in: phProv=0x18d724, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18d724*=0x5d0e80) returned 1 [0040.700] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18d6dc | out: phHash=0x18d6dc) returned 1 [0040.700] CryptHashData (hHash=0x5c9180, pbData=0x1fc6440, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.700] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9180, dwFlags=0x0, phKey=0x18d720 | out: phKey=0x18d720*=0x5c9300) returned 1 [0040.700] CryptDestroyHash (hHash=0x5c9180) returned 1 [0040.700] CryptEncrypt (in: hKey=0x5c9300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18d730*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18d730) returned 0 [0040.701] GetLastError () returned 0xea [0040.701] CryptEncrypt (in: hKey=0x5c9300, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18d72c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18d72c*=0x260) returned 1 [0040.701] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\c\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0040.701] WriteFile (in: hFile=0x120, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18d4b0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18d4b0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.702] SetEndOfFile (hFile=0x120) returned 1 [0040.702] CloseHandle (hObject=0x120) returned 1 [0040.703] CryptDestroyKey (hKey=0x5c9300) returned 1 [0040.703] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.703] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\C\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18d6c8 | out: lpFindFileData=0x18d6c8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9300 [0040.703] FindNextFileA (in: hFindFile=0x5c9300, lpFindFileData=0x18d6c8 | out: lpFindFileData=0x18d6c8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.703] FindNextFileA (in: hFindFile=0x5c9300, lpFindFileData=0x18d6c8 | out: lpFindFileData=0x18d6c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8bf2c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.703] FindNextFileA (in: hFindFile=0x5c9300, lpFindFileData=0x18d6c8 | out: lpFindFileData=0x18d6c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8bf2c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.703] FindClose (in: hFindFile=0x5c9300 | out: hFindFile=0x5c9300) returned 1 [0040.703] FindNextFileA (in: hFindFile=0x5c92c0, lpFindFileData=0x18d930 | out: lpFindFileData=0x18d930*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 0 [0040.703] FindClose (in: hFindFile=0x5c92c0 | out: hFindFile=0x5c92c0) returned 1 [0040.703] FindNextFileA (in: hFindFile=0x5c9280, lpFindFileData=0x18db98 | out: lpFindFileData=0x18db98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PrivacIE", cAlternateFileName="")) returned 0 [0040.703] FindClose (in: hFindFile=0x5c9280 | out: hFindFile=0x5c9280) returned 1 [0040.703] FindNextFileA (in: hFindFile=0x5c9240, lpFindFileData=0x18de00 | out: lpFindFileData=0x18de00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows", cAlternateFileName="")) returned 0 [0040.703] FindClose (in: hFindFile=0x5c9240 | out: hFindFile=0x5c9240) returned 1 [0040.703] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e068 | out: lpFindFileData=0x18e068*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0040.703] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0040.703] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Roaming", cAlternateFileName="")) returned 0 [0040.703] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0040.704] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8bccad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.704] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8bccad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.704] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.704] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8bccad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.704] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8bccad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8bccad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bccad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.704] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.704] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Users", cAlternateFileName="")) returned 0 [0040.704] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.704] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ba6970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ba6970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ba6970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.704] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ba6970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ba6970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ba6970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.704] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.704] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20455254, dwReserved1=0x52434e45, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0040.704] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.704] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Themes", cAlternateFileName="")) returned 1 [0040.704] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.705] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.705] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.705] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0040.705] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.705] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.705] GetLastError () returned 0xea [0040.705] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.705] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.706] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.707] SetEndOfFile (hFile=0xf0) returned 1 [0040.707] CloseHandle (hObject=0xf0) returned 1 [0040.707] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.707] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.707] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.708] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.708] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1 [0040.708] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8bf2c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.708] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8bf2c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8bf2c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8bf2c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.708] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.708] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0040.708] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c3ce000, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1 [0040.708] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1 [0040.708] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1 [0040.708] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1 [0040.708] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1 [0040.708] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="WER", cAlternateFileName="")) returned 1 [0040.708] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.709] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.709] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.709] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0040.709] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.709] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.709] GetLastError () returned 0xea [0040.709] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\wer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.710] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.711] SetEndOfFile (hFile=0xf0) returned 1 [0040.711] CloseHandle (hObject=0xf0) returned 1 [0040.711] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.711] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.711] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.712] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ERC", cAlternateFileName="")) returned 1 [0040.712] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.712] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.712] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.712] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c91c0) returned 1 [0040.712] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.712] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.712] GetLastError () returned 0xea [0040.712] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.713] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\wer\\erc\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.713] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.714] SetEndOfFile (hFile=0x108) returned 1 [0040.714] CloseHandle (hObject=0x108) returned 1 [0040.714] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.714] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.715] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.715] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c18d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.715] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c18d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.715] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.715] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c18d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.715] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0040.715] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.715] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.715] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.715] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0040.715] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0040.715] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.716] GetLastError () returned 0xea [0040.716] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\wer\\reportarchive\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.716] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.717] SetEndOfFile (hFile=0x108) returned 1 [0040.717] CloseHandle (hObject=0x108) returned 1 [0040.717] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.717] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.718] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.718] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c18d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.718] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c18d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.718] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.718] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0 [0040.718] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.718] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456576, dwReserved1=0x52434e45, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0040.718] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456576, dwReserved1=0x52434e45, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0 [0040.718] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.718] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c2e6574, dwReserved1=0x6137676f, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1 [0040.718] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.719] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.719] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.719] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0040.719] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.719] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.719] GetLastError () returned 0xea [0040.719] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.719] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.719] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.720] SetEndOfFile (hFile=0xe8) returned 1 [0040.720] CloseHandle (hObject=0xe8) returned 1 [0040.720] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.720] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.721] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.721] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.721] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1 [0040.721] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1 [0040.721] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1 [0040.721] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Backup", cAlternateFileName="")) returned 1 [0040.721] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.721] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.721] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.721] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0040.721] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.721] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.722] GetLastError () returned 0xea [0040.722] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.722] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.722] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.723] SetEndOfFile (hFile=0xf0) returned 1 [0040.723] CloseHandle (hObject=0xf0) returned 1 [0040.723] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.723] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.723] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.723] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.724] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c18d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.724] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="old", cAlternateFileName="")) returned 1 [0040.724] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.724] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.724] CryptHashData (hHash=0x5c9140, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.724] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c91c0) returned 1 [0040.724] CryptDestroyHash (hHash=0x5c9140) returned 1 [0040.724] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ecd8) returned 0 [0040.724] GetLastError () returned 0xea [0040.724] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.726] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.727] SetEndOfFile (hFile=0x108) returned 1 [0040.727] CloseHandle (hObject=0x108) returned 1 [0040.727] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.727] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c3eef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.727] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c3eef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c3eef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c3eef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0040.727] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="old", cAlternateFileName="")) returned 0 [0040.727] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="edb.log", cAlternateFileName="")) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c18d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c18d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c18d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="oeold.xml", cAlternateFileName="")) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa4169b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4169b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0040.728] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.728] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.728] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.728] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c91c0) returned 1 [0040.728] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.728] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.728] GetLastError () returned 0xea [0040.728] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.729] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\stationery\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.729] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.730] SetEndOfFile (hFile=0xf0) returned 1 [0040.730] CloseHandle (hObject=0xf0) returned 1 [0040.730] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.730] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.730] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c3eef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.730] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c3eef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.730] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0040.730] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa40d15d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa40d15d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa40d15d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Bears.jpg.crypt", cAlternateFileName="BEARSJ~1.CRY")) returned 1 [0040.730] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa40d15d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa40d15d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa40d15d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0040.730] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0040.730] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa40f7730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa40f7730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa40f7730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Garden.jpg.crypt", cAlternateFileName="GARDEN~1.CRY")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa40f7730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa40f7730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa40f7730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="GreenBubbles.jpg.crypt", cAlternateFileName="GREENB~1.CRY")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa40f7730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa40f7730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa411d890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HandPrints.jpg.crypt", cAlternateFileName="HANDPR~1.CRY")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c3eef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c3eef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa411d890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa411d890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa411d890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="OrangeCircles.jpg.crypt", cAlternateFileName="ORANGE~1.CRY")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa411d890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa411d890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa41439f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Peacock.jpg.crypt", cAlternateFileName="PEACOC~1.CRY")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa41439f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa41439f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa41439f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Roses.jpg.crypt", cAlternateFileName="ROSESJ~1.CRY")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa41439f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa41439f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa41439f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ShadesOfBlue.jpg.crypt", cAlternateFileName="SHADES~1.CRY")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4169b50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4169b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4169b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SoftBlue.jpg.crypt", cAlternateFileName="SOFTBL~1.CRY")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4169b50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4169b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4169b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Stars.jpg.crypt", cAlternateFileName="STARSJ~1.CRY")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4169b50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4169b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4169b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Stars.jpg.crypt", cAlternateFileName="STARSJ~1.CRY")) returned 0 [0040.731] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x74707972, dwReserved1=0x72747079, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74707972, dwReserved1=0x72747079, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74707972, dwReserved1=0x72747079, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0040.731] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0040.731] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.732] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.732] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.732] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c91c0) returned 1 [0040.732] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.732] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.732] GetLastError () returned 0xea [0040.732] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.732] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.733] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.734] SetEndOfFile (hFile=0xe8) returned 1 [0040.734] CloseHandle (hObject=0xe8) returned 1 [0040.734] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.734] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.734] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c3eef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.734] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c3eef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.735] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="12.0", cAlternateFileName="")) returned 1 [0040.735] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.735] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.735] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.735] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0040.735] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.735] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.735] GetLastError () returned 0xea [0040.735] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.736] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows media\\12.0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.736] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.737] SetEndOfFile (hFile=0xf0) returned 1 [0040.737] CloseHandle (hObject=0xf0) returned 1 [0040.737] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.737] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.737] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c3eef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.737] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c3eef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.737] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c3eef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c3eef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.737] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1 [0040.737] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1 [0040.738] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0 [0040.738] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.738] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c3eef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c3eef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.738] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c3eef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c3eef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.738] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.738] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa418fcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa418fcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0040.738] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.738] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.738] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.738] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0040.738] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0040.738] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f1a8) returned 0 [0040.738] GetLastError () returned 0xea [0040.738] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.739] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.741] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.742] SetEndOfFile (hFile=0xe8) returned 1 [0040.742] CloseHandle (hObject=0xe8) returned 1 [0040.742] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.742] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.742] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.742] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.742] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0040.742] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.743] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.743] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.743] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0040.743] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0040.743] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18ef40) returned 0 [0040.743] GetLastError () returned 0xea [0040.743] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.743] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows sidebar\\gadgets\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.744] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.745] SetEndOfFile (hFile=0xf0) returned 1 [0040.745] CloseHandle (hObject=0xf0) returned 1 [0040.745] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.745] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.745] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.745] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.745] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c65050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.745] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c65050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.745] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.745] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c3eef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c3eef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.745] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa418fcb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa418fcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa418fcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Settings.ini.crypt", cAlternateFileName="SETTIN~1.CRY")) returned 1 [0040.745] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa418fcb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa418fcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa418fcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Settings.ini.crypt", cAlternateFileName="SETTIN~1.CRY")) returned 0 [0040.745] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.746] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa418fcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa418fcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0040.746] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0040.746] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x6769666e, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0040.746] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0040.746] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0040.746] CryptHashData (hHash=0x5c9000, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.746] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8ec0) returned 1 [0040.746] CryptDestroyHash (hHash=0x5c9000) returned 1 [0040.746] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f410) returned 0 [0040.746] GetLastError () returned 0xea [0040.746] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f40c*=0x260) returned 1 [0040.747] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft help\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0040.747] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0040.748] SetEndOfFile (hFile=0xec) returned 1 [0040.748] CloseHandle (hObject=0xec) returned 1 [0040.748] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.748] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.748] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.749] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.749] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c65050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.749] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c65050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.749] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.749] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0040.749] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0040.749] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0040.749] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.749] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9000) returned 1 [0040.750] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.750] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0964*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e0964, pdwDataLen=0x18f410) returned 0 [0040.750] GetLastError () returned 0xea [0040.750] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0964*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e0964*, pdwDataLen=0x18f40c*=0x260) returned 1 [0040.750] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0040.750] WriteFile (in: hFile=0xec, lpBuffer=0x33e2204*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33e2204*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0040.751] SetEndOfFile (hFile=0xec) returned 1 [0040.751] CloseHandle (hObject=0xec) returned 1 [0040.751] CryptDestroyKey (hKey=0x5c9000) returned 1 [0040.751] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.751] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0040.751] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.751] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Firefox", cAlternateFileName="")) returned 1 [0040.752] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.752] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.752] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.752] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0040.752] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.752] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1adc*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1adc, pdwDataLen=0x18f1a8) returned 0 [0040.752] GetLastError () returned 0xea [0040.752] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1adc*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1adc*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.752] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.753] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.754] SetEndOfFile (hFile=0xe8) returned 1 [0040.754] CloseHandle (hObject=0xe8) returned 1 [0040.754] CryptDestroyKey (hKey=0x5c9040) returned 1 [0040.754] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.754] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0040.754] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.754] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c65050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.754] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Profiles", cAlternateFileName="")) returned 1 [0040.754] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.755] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.755] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.755] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c91c0) returned 1 [0040.755] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.755] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18ef40) returned 0 [0040.755] GetLastError () returned 0xea [0040.755] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.755] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.756] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.757] SetEndOfFile (hFile=0xf0) returned 1 [0040.757] CloseHandle (hObject=0xf0) returned 1 [0040.757] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.757] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.757] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.757] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.757] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c65050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.757] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0040.757] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.758] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.758] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.758] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9140) returned 1 [0040.758] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.758] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18ecd8) returned 0 [0040.758] GetLastError () returned 0xea [0040.758] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.758] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.759] WriteFile (in: hFile=0x108, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.759] SetEndOfFile (hFile=0x108) returned 1 [0040.759] CloseHandle (hObject=0x108) returned 1 [0040.760] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.760] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.760] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.760] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.760] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Cache", cAlternateFileName="")) returned 1 [0040.760] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.760] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.760] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.760] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0040.760] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.760] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18ea70) returned 0 [0040.760] GetLastError () returned 0xea [0040.761] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.761] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.762] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.763] SetEndOfFile (hFile=0x114) returned 1 [0040.763] CloseHandle (hObject=0x114) returned 1 [0040.763] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.763] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.763] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.763] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.763] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0", cAlternateFileName="")) returned 1 [0040.763] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.764] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.764] CryptHashData (hHash=0x5c8ec0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.764] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c90c0) returned 1 [0040.764] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.764] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07fc*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e07fc, pdwDataLen=0x18e808) returned 0 [0040.764] GetLastError () returned 0xea [0040.764] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07fc*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e07fc*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.764] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.765] WriteFile (in: hFile=0x104, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.765] SetEndOfFile (hFile=0x104) returned 1 [0040.766] CloseHandle (hObject=0x104) returned 1 [0040.766] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.766] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.766] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.766] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.766] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8c39470, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="98", cAlternateFileName="")) returned 1 [0040.766] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.767] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.767] CryptHashData (hHash=0x5c8ec0, pbData=0x33e0968, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.767] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9200) returned 1 [0040.767] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.767] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0700*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0700, pdwDataLen=0x18e5a0) returned 0 [0040.767] GetLastError () returned 0xea [0040.767] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0700*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e0700*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.767] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.767] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.768] SetEndOfFile (hFile=0xfc) returned 1 [0040.768] CloseHandle (hObject=0xfc) returned 1 [0040.768] CryptDestroyKey (hKey=0x5c9200) returned 1 [0040.768] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.768] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0040.769] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.769] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8c39470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8c39470, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8cd19f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xb67e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="B60F3d01", cAlternateFileName="")) returned 1 [0040.769] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c8b1b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.769] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c8b1b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.769] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0040.769] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="A8", cAlternateFileName="")) returned 1 [0040.769] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.769] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.769] CryptHashData (hHash=0x5c9200, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.769] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c8ec0) returned 1 [0040.770] CryptDestroyHash (hHash=0x5c9200) returned 1 [0040.770] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18e5a0) returned 0 [0040.770] GetLastError () returned 0xea [0040.770] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.770] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.873] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.874] SetEndOfFile (hFile=0xfc) returned 1 [0040.874] CloseHandle (hObject=0xfc) returned 1 [0040.874] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.874] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.874] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8d95b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8d95b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.875] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8d95b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8d95b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.875] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81eff750, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81eff750, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81eff750, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4898, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="C3B7Bd01", cAlternateFileName="")) returned 1 [0040.875] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c8b1b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8d95b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.875] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c8b1b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8d95b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.875] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.875] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c8b1b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.875] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c8b1b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.875] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.875] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="1", cAlternateFileName="")) returned 1 [0040.875] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.876] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.876] CryptHashData (hHash=0x5c90c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.876] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c8ec0) returned 1 [0040.876] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.876] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2220*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e2220, pdwDataLen=0x18e808) returned 0 [0040.876] GetLastError () returned 0xea [0040.876] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2220*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e2220*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.876] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.877] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.878] SetEndOfFile (hFile=0x104) returned 1 [0040.878] CloseHandle (hObject=0x104) returned 1 [0040.878] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.878] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.878] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8d95b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8d95b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.878] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8d95b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8d95b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.878] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0B", cAlternateFileName="")) returned 1 [0040.878] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.879] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.879] CryptHashData (hHash=0x5c90c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.879] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9200) returned 1 [0040.879] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.879] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2220*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2220, pdwDataLen=0x18e5a0) returned 0 [0040.879] GetLastError () returned 0xea [0040.879] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2220*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2220*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.879] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.880] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.881] SetEndOfFile (hFile=0xfc) returned 1 [0040.881] CloseHandle (hObject=0xfc) returned 1 [0040.881] CryptDestroyKey (hKey=0x5c9200) returned 1 [0040.881] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.881] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8d95b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8d95b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0040.881] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8d95b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8d95b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.881] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7680bb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7680bb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7680bb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x204fd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="FCBF5d01", cAlternateFileName="")) returned 1 [0040.881] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8d95b50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8d95b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.881] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8d95b50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8d95b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.881] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0040.881] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="C2", cAlternateFileName="")) returned 1 [0040.881] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.882] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.882] CryptHashData (hHash=0x5c9200, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.882] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c90c0) returned 1 [0040.882] CryptDestroyHash (hHash=0x5c9200) returned 1 [0040.882] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2220*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2220, pdwDataLen=0x18e5a0) returned 0 [0040.882] GetLastError () returned 0xea [0040.882] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2220*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2220*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.882] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.883] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.884] SetEndOfFile (hFile=0xfc) returned 1 [0040.884] CloseHandle (hObject=0xfc) returned 1 [0040.884] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.884] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.884] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.884] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.884] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bbed0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8272e2f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa05, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0B619d01", cAlternateFileName="")) returned 1 [0040.884] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8dbbcb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.884] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8dbbcb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.884] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.884] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d7ec50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="F6", cAlternateFileName="")) returned 1 [0040.884] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.885] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.885] CryptHashData (hHash=0x5c90c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.885] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9200) returned 1 [0040.885] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.885] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2220*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2220, pdwDataLen=0x18e5a0) returned 0 [0040.885] GetLastError () returned 0xea [0040.885] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2220*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2220*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.886] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.887] SetEndOfFile (hFile=0xfc) returned 1 [0040.887] CloseHandle (hObject=0xfc) returned 1 [0040.887] CryptDestroyKey (hKey=0x5c9200) returned 1 [0040.887] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.887] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0040.887] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.887] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa60b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CBD4Dd01", cAlternateFileName="")) returned 1 [0040.887] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8dbbcb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.887] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8dbbcb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.887] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0040.887] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8d95b50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8d95b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8d95b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.887] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8d95b50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8d95b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8d95b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.887] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.888] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="2", cAlternateFileName="")) returned 1 [0040.888] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.888] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.888] CryptHashData (hHash=0x5c8ec0, pbData=0x1fc6440, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.888] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9200) returned 1 [0040.888] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.888] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2220*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e2220, pdwDataLen=0x18e808) returned 0 [0040.888] GetLastError () returned 0xea [0040.888] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2220*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e2220*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\2\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.889] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.890] SetEndOfFile (hFile=0x104) returned 1 [0040.890] CloseHandle (hObject=0x104) returned 1 [0040.890] CryptDestroyKey (hKey=0x5c9200) returned 1 [0040.890] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.890] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0040.890] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.890] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8dbbcb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.890] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8dbbcb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.890] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0040.891] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="3", cAlternateFileName="")) returned 1 [0040.891] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.891] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.891] CryptHashData (hHash=0x5c9200, pbData=0x33e1d30, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.891] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c8ec0) returned 1 [0040.891] CryptDestroyHash (hHash=0x5c9200) returned 1 [0040.891] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ac8, pdwDataLen=0x18e808) returned 0 [0040.891] GetLastError () returned 0xea [0040.891] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ac8*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.892] WriteFile (in: hFile=0x104, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.893] SetEndOfFile (hFile=0x104) returned 1 [0040.893] CloseHandle (hObject=0x104) returned 1 [0040.893] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.893] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.893] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.893] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.893] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb727c690, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="4B", cAlternateFileName="")) returned 1 [0040.893] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.894] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.894] CryptHashData (hHash=0x5c9200, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.894] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c90c0) returned 1 [0040.894] CryptDestroyHash (hHash=0x5c9200) returned 1 [0040.894] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21c0*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e21c0, pdwDataLen=0x18e5a0) returned 0 [0040.894] GetLastError () returned 0xea [0040.894] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21c0*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e21c0*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.894] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.895] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.896] SetEndOfFile (hFile=0xfc) returned 1 [0040.896] CloseHandle (hObject=0xfc) returned 1 [0040.896] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.896] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.896] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.897] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.897] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb727c690, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb727c690, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb72eeab0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x20543, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1D8FDd01", cAlternateFileName="")) returned 1 [0040.897] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8dbbcb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.897] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8dbbcb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.897] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.897] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8dbbcb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.897] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8dbbcb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8dbbcb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8dbbcb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.897] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.897] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="4", cAlternateFileName="")) returned 1 [0040.897] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.898] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.898] CryptHashData (hHash=0x5c8ec0, pbData=0x33e1d30, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.898] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c90c0) returned 1 [0040.898] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.898] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ac8, pdwDataLen=0x18e808) returned 0 [0040.898] GetLastError () returned 0xea [0040.898] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ac8*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.898] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\4\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.898] WriteFile (in: hFile=0x104, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.899] SetEndOfFile (hFile=0x104) returned 1 [0040.899] CloseHandle (hObject=0x104) returned 1 [0040.899] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.900] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.900] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.900] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.900] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8de1e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.900] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8de1e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.900] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.900] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb64f2970, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="5", cAlternateFileName="")) returned 1 [0040.900] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.901] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.901] CryptHashData (hHash=0x5c90c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.901] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c8ec0) returned 1 [0040.901] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.901] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e223c*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e223c, pdwDataLen=0x18e808) returned 0 [0040.901] GetLastError () returned 0xea [0040.901] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e223c*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e223c*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.901] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\5\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.901] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.902] SetEndOfFile (hFile=0x104) returned 1 [0040.902] CloseHandle (hObject=0x104) returned 1 [0040.902] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.903] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.903] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.903] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.903] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8de1e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.903] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8de1e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.903] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.903] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="6", cAlternateFileName="")) returned 1 [0040.903] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.903] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.904] CryptHashData (hHash=0x5c8ec0, pbData=0x33e1d30, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.904] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c90c0) returned 1 [0040.904] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.904] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ac8, pdwDataLen=0x18e808) returned 0 [0040.904] GetLastError () returned 0xea [0040.904] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ac8*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.904] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\6\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.905] WriteFile (in: hFile=0x104, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.905] SetEndOfFile (hFile=0x104) returned 1 [0040.905] CloseHandle (hObject=0x104) returned 1 [0040.906] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.906] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.906] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.906] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.906] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8de1e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.906] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8de1e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.906] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.906] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="7", cAlternateFileName="")) returned 1 [0040.906] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.907] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.907] CryptHashData (hHash=0x5c90c0, pbData=0x33e0700, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.907] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c8ec0) returned 1 [0040.907] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.907] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e223c*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e223c, pdwDataLen=0x18e808) returned 0 [0040.907] GetLastError () returned 0xea [0040.907] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e223c*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e223c*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.907] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\7\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.907] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.908] SetEndOfFile (hFile=0x104) returned 1 [0040.908] CloseHandle (hObject=0x104) returned 1 [0040.908] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.908] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.909] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.909] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8de1e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.909] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8de1e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.909] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.909] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="8", cAlternateFileName="")) returned 1 [0040.909] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.909] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.909] CryptHashData (hHash=0x5c8ec0, pbData=0x33e1d30, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.909] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c90c0) returned 1 [0040.909] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.910] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ac8, pdwDataLen=0x18e808) returned 0 [0040.910] GetLastError () returned 0xea [0040.910] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ac8*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.910] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\8\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.910] WriteFile (in: hFile=0x104, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.911] SetEndOfFile (hFile=0x104) returned 1 [0040.911] CloseHandle (hObject=0x104) returned 1 [0040.911] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.911] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.911] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.912] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.912] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8de1e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.912] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8de1e10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8de1e10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8de1e10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.913] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.913] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="9", cAlternateFileName="")) returned 1 [0040.913] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.914] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.914] CryptHashData (hHash=0x5c90c0, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.914] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c8ec0) returned 1 [0040.914] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.914] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21c0*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e21c0, pdwDataLen=0x18e808) returned 0 [0040.914] GetLastError () returned 0xea [0040.914] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21c0*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e21c0*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.914] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.915] SetEndOfFile (hFile=0x104) returned 1 [0040.915] CloseHandle (hObject=0x104) returned 1 [0040.915] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.916] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.916] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.916] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.916] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="10", cAlternateFileName="")) returned 1 [0040.916] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.916] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.916] CryptHashData (hHash=0x5c90c0, pbData=0x33e1d30, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.916] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9200) returned 1 [0040.916] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.916] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ac8, pdwDataLen=0x18e5a0) returned 0 [0040.917] GetLastError () returned 0xea [0040.917] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ac8*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.917] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.917] WriteFile (in: hFile=0xfc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.918] SetEndOfFile (hFile=0xfc) returned 1 [0040.918] CloseHandle (hObject=0xfc) returned 1 [0040.918] CryptDestroyKey (hKey=0x5c9200) returned 1 [0040.918] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.918] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0040.919] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.919] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x534f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="16A09d01", cAlternateFileName="")) returned 1 [0040.919] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e07f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.919] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e07f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.919] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0040.919] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7d58af0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="2C", cAlternateFileName="")) returned 1 [0040.919] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.919] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.919] CryptHashData (hHash=0x5c9200, pbData=0x33e0730, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.919] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c90c0) returned 1 [0040.919] CryptDestroyHash (hHash=0x5c9200) returned 1 [0040.919] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2264*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2264, pdwDataLen=0x18e5a0) returned 0 [0040.919] GetLastError () returned 0xea [0040.919] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2264*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2264*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.920] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.920] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.921] SetEndOfFile (hFile=0xfc) returned 1 [0040.921] CloseHandle (hObject=0xfc) returned 1 [0040.921] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.921] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.922] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.922] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d58af0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d58af0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7dcaf10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x133d5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="24B53d01", cAlternateFileName="")) returned 1 [0040.922] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e07f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.922] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e07f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.922] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.922] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f47cd0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="61", cAlternateFileName="")) returned 1 [0040.922] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.922] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.922] CryptHashData (hHash=0x5c90c0, pbData=0x33e1d30, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.923] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9200) returned 1 [0040.923] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.923] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ac8, pdwDataLen=0x18e5a0) returned 0 [0040.923] GetLastError () returned 0xea [0040.923] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ac8*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.923] WriteFile (in: hFile=0xfc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.924] SetEndOfFile (hFile=0xfc) returned 1 [0040.924] CloseHandle (hObject=0xfc) returned 1 [0040.924] CryptDestroyKey (hKey=0x5c9200) returned 1 [0040.924] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.924] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0040.925] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.925] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f47cd0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f47cd0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fba0f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa949, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="28E95d01", cAlternateFileName="")) returned 1 [0040.925] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e07f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.925] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e07f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.925] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0040.925] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="E0", cAlternateFileName="")) returned 1 [0040.925] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.925] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.925] CryptHashData (hHash=0x5c9200, pbData=0x33e0700, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.925] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c90c0) returned 1 [0040.926] CryptDestroyHash (hHash=0x5c9200) returned 1 [0040.926] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21c4*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e21c4, pdwDataLen=0x18e5a0) returned 0 [0040.926] GetLastError () returned 0xea [0040.926] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21c4*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e21c4*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.926] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.926] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.927] SetEndOfFile (hFile=0xfc) returned 1 [0040.927] CloseHandle (hObject=0xfc) returned 1 [0040.928] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.928] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.928] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.928] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.928] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e8d330, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e8d330, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e8d330, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x404f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="F17B2d01", cAlternateFileName="")) returned 1 [0040.928] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e07f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.928] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e07f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.928] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.928] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e07f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.928] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e07f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e07f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e07f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.928] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.928] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="A", cAlternateFileName="")) returned 1 [0040.928] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.929] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.929] CryptHashData (hHash=0x5c8ec0, pbData=0x33e1d30, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.929] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c90c0) returned 1 [0040.929] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.929] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ac8, pdwDataLen=0x18e808) returned 0 [0040.929] GetLastError () returned 0xea [0040.929] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ac8*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.929] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\a\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.930] WriteFile (in: hFile=0x104, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.931] SetEndOfFile (hFile=0x104) returned 1 [0040.931] CloseHandle (hObject=0x104) returned 1 [0040.931] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.931] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.931] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.931] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.931] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e2e0d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.931] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e2e0d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.931] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.931] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6518ad0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="B", cAlternateFileName="")) returned 1 [0040.931] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.932] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.932] CryptHashData (hHash=0x5c90c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.932] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c8ec0) returned 1 [0040.932] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.932] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2190*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e2190, pdwDataLen=0x18e808) returned 0 [0040.932] GetLastError () returned 0xea [0040.932] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2190*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e2190*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.932] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\b\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.933] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.933] SetEndOfFile (hFile=0x104) returned 1 [0040.934] CloseHandle (hObject=0x104) returned 1 [0040.934] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.934] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.934] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.934] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.934] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e2e0d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.934] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e2e0d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.934] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.934] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="C", cAlternateFileName="")) returned 1 [0040.934] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.935] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.935] CryptHashData (hHash=0x5c8ec0, pbData=0x33e1d30, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.935] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c90c0) returned 1 [0040.935] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.935] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ac8, pdwDataLen=0x18e808) returned 0 [0040.935] GetLastError () returned 0xea [0040.935] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ac8*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.935] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.936] WriteFile (in: hFile=0x104, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.936] SetEndOfFile (hFile=0x104) returned 1 [0040.936] CloseHandle (hObject=0x104) returned 1 [0040.937] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.937] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.937] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.937] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.937] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7eaf750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="E6", cAlternateFileName="")) returned 1 [0040.937] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.937] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.938] CryptHashData (hHash=0x5c8ec0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.938] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9200) returned 1 [0040.938] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.938] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2250*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2250, pdwDataLen=0x18e5a0) returned 0 [0040.938] GetLastError () returned 0xea [0040.938] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2250*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2250*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.938] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.938] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.939] SetEndOfFile (hFile=0xfc) returned 1 [0040.939] CloseHandle (hObject=0xfc) returned 1 [0040.939] CryptDestroyKey (hKey=0x5c9200) returned 1 [0040.939] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.939] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0040.940] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.940] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7eaf750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7eaf750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f21b70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x21839, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="9DCB7d01", cAlternateFileName="")) returned 1 [0040.940] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e2e0d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.940] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e2e0d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.940] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0040.940] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e2e0d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.940] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e2e0d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.940] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.940] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="D", cAlternateFileName="")) returned 1 [0040.940] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.941] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.941] CryptHashData (hHash=0x5c90c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.941] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9200) returned 1 [0040.941] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.941] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20c4*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e20c4, pdwDataLen=0x18e808) returned 0 [0040.941] GetLastError () returned 0xea [0040.941] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20c4*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e20c4*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.941] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.941] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.942] SetEndOfFile (hFile=0x104) returned 1 [0040.942] CloseHandle (hObject=0x104) returned 1 [0040.942] CryptDestroyKey (hKey=0x5c9200) returned 1 [0040.942] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.942] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0040.943] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.943] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="08", cAlternateFileName="")) returned 1 [0040.943] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.943] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.943] CryptHashData (hHash=0x5c90c0, pbData=0x33e1d30, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.943] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c8ec0) returned 1 [0040.943] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.944] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ac8, pdwDataLen=0x18e5a0) returned 0 [0040.944] GetLastError () returned 0xea [0040.944] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ac8*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.944] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.944] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.945] SetEndOfFile (hFile=0xfc) returned 1 [0040.945] CloseHandle (hObject=0xfc) returned 1 [0040.946] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.946] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.946] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.946] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.946] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81e671d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81e671d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81e671d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8266, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="71469d01", cAlternateFileName="")) returned 1 [0040.946] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e54230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.946] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e54230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.946] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.946] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e2e0d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.946] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e2e0d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e2e0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e2e0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.946] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0040.946] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="E", cAlternateFileName="")) returned 1 [0040.946] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.947] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.947] CryptHashData (hHash=0x5c9200, pbData=0x33e20ac, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.947] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c8ec0) returned 1 [0040.947] CryptDestroyHash (hHash=0x5c9200) returned 1 [0040.947] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1e44*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e1e44, pdwDataLen=0x18e808) returned 0 [0040.947] GetLastError () returned 0xea [0040.947] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1e44*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e1e44*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.947] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.948] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.948] SetEndOfFile (hFile=0x104) returned 1 [0040.949] CloseHandle (hObject=0x104) returned 1 [0040.949] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.949] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.949] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.949] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.949] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="69", cAlternateFileName="")) returned 1 [0040.949] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.949] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.949] CryptHashData (hHash=0x5c9200, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.949] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c90c0) returned 1 [0040.950] CryptDestroyHash (hHash=0x5c9200) returned 1 [0040.950] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18e5a0) returned 0 [0040.950] GetLastError () returned 0xea [0040.950] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.950] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.950] WriteFile (in: hFile=0xfc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.951] SetEndOfFile (hFile=0xfc) returned 1 [0040.951] CloseHandle (hObject=0xfc) returned 1 [0040.951] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.951] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.951] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.952] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.952] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb80063b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10d22, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="885EEd01", cAlternateFileName="")) returned 1 [0040.952] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e54230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.952] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e54230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.952] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.952] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e54230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.952] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e54230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.952] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.952] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="F", cAlternateFileName="")) returned 1 [0040.952] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0040.952] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0040.953] CryptHashData (hHash=0x5c8ec0, pbData=0x33e0730, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.953] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c90c0) returned 1 [0040.953] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.953] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e2248, pdwDataLen=0x18e808) returned 0 [0040.953] GetLastError () returned 0xea [0040.953] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e2248*, pdwDataLen=0x18e804*=0x260) returned 1 [0040.953] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0040.953] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0040.954] SetEndOfFile (hFile=0x104) returned 1 [0040.954] CloseHandle (hObject=0x104) returned 1 [0040.954] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.954] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.954] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.955] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.955] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7f6de30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="23", cAlternateFileName="")) returned 1 [0040.955] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.955] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.955] CryptHashData (hHash=0x5c8ec0, pbData=0x1fe5350, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.955] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9200) returned 1 [0040.955] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0040.955] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e214c*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e214c, pdwDataLen=0x18e5a0) returned 0 [0040.955] GetLastError () returned 0xea [0040.955] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e214c*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e214c*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.956] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.956] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.958] SetEndOfFile (hFile=0xfc) returned 1 [0040.958] CloseHandle (hObject=0xfc) returned 1 [0040.958] CryptDestroyKey (hKey=0x5c9200) returned 1 [0040.958] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.958] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0040.958] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.958] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7f6de30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7f6de30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7fe0250, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf888, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7E0FEd01", cAlternateFileName="")) returned 1 [0040.958] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e54230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.958] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e54230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.958] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0040.958] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82329dd0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="F0", cAlternateFileName="")) returned 1 [0040.958] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0040.959] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0040.959] CryptHashData (hHash=0x5c9200, pbData=0x33e1d30, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.960] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c8ec0) returned 1 [0040.960] CryptDestroyHash (hHash=0x5c9200) returned 1 [0040.960] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ac8, pdwDataLen=0x18e5a0) returned 0 [0040.960] GetLastError () returned 0xea [0040.960] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ac8*, pdwDataLen=0x18e59c*=0x260) returned 1 [0040.960] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0040.960] WriteFile (in: hFile=0xfc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0040.961] SetEndOfFile (hFile=0xfc) returned 1 [0040.961] CloseHandle (hObject=0xfc) returned 1 [0040.961] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0040.961] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.961] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8e7a390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e7a390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0040.962] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8e7a390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e7a390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.962] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82329dd0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82329dd0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x823c2350, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa80f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ECB2Dd01", cAlternateFileName="")) returned 1 [0040.962] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e7a390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e7a390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e7a390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.962] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e7a390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e7a390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e7a390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.962] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0040.962] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e54230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.962] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e54230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e54230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e54230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.962] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.962] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c8b1b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.962] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x851226b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_CACHE_001_", cAlternateFileName="_CACHE~2")) returned 1 [0040.962] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x851e0d90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_CACHE_002_", cAlternateFileName="_CACHE~3")) returned 1 [0040.962] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8529f470, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_CACHE_003_", cAlternateFileName="_CACHE~4")) returned 1 [0040.962] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8535db50, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2114, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_CACHE_MAP_", cAlternateFileName="_CACHE~1")) returned 1 [0040.962] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x8535db50, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2114, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_CACHE_MAP_", cAlternateFileName="_CACHE~1")) returned 0 [0040.962] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.962] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c8b1b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c8b1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c8b1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.962] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbecfd400, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbecfd400, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="OfflineCache", cAlternateFileName="OFFLIN~1")) returned 1 [0040.962] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.963] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.963] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.963] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c90c0) returned 1 [0040.963] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.963] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20d0*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e20d0, pdwDataLen=0x18ea70) returned 0 [0040.963] GetLastError () returned 0xea [0040.963] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20d0*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e20d0*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.963] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.964] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.965] SetEndOfFile (hFile=0x114) returned 1 [0040.965] CloseHandle (hObject=0x114) returned 1 [0040.965] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.965] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.965] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e7a390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e7a390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.965] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbece2650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8e7a390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e7a390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.965] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e7a390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e7a390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e7a390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.965] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc399b820, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 1 [0040.965] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbece4d60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbece4d60, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc399b820, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.sqlite", cAlternateFileName="INDEX~1.SQL")) returned 0 [0040.965] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.965] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x826bbed0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20455265, dwReserved1=0x52434e45, cFileName="safebrowsing", cAlternateFileName="SAFEBR~2")) returned 1 [0040.965] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.966] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.966] CryptHashData (hHash=0x5c90c0, pbData=0x33e1d30, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.966] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0040.966] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.966] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ac8, pdwDataLen=0x18ea70) returned 0 [0040.966] GetLastError () returned 0xea [0040.966] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ac8*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.966] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.967] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.968] SetEndOfFile (hFile=0x114) returned 1 [0040.968] CloseHandle (hObject=0x114) returned 1 [0040.968] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.968] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.968] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8e7a390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e7a390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.969] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8e7a390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e7a390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.969] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e7a390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e7a390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e7a390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.969] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x825fd7f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x825fd7f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x825fd7f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="test-malware-simple.cache", cAlternateFileName="TEST-M~1.CAC")) returned 1 [0040.969] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8234ff30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8234ff30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="test-malware-simple.pset", cAlternateFileName="TEST-M~1.PSE")) returned 1 [0040.969] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82376090, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="test-malware-simple.sbstore", cAlternateFileName="TEST-M~1.SBS")) returned 1 [0040.969] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82695d70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82695d70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82695d70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="test-phish-simple.cache", cAlternateFileName="TEST-P~1.CAC")) returned 1 [0040.969] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82376090, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82376090, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826bbed0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="test-phish-simple.pset", cAlternateFileName="TEST-P~1.PSE")) returned 1 [0040.969] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82649ab0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82649ab0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 1 [0040.969] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82649ab0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x82649ab0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x82649ab0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="test-phish-simple.sbstore", cAlternateFileName="TEST-P~1.SBS")) returned 0 [0040.969] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.969] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x706d6973, dwReserved1=0x732e656c, cFileName="startupCache", cAlternateFileName="STARTU~1")) returned 1 [0040.969] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.970] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.970] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.970] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c90c0) returned 1 [0040.970] CryptDestroyHash (hHash=0x5c9100) returned 1 [0040.970] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20ec*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e20ec, pdwDataLen=0x18ea70) returned 0 [0040.970] GetLastError () returned 0xea [0040.970] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20ec*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e20ec*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.970] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.970] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.979] SetEndOfFile (hFile=0x114) returned 1 [0040.979] CloseHandle (hObject=0x114) returned 1 [0040.979] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.979] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.979] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8e7a390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e7a390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.979] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x807f0230, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa8e7a390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8e7a390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.979] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8e7a390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8e7a390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ea04f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.979] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x854b47b0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe59f6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="startupCache.4.little", cAlternateFileName="STARTU~1.LIT")) returned 1 [0040.979] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x854b47b0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe59f6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="startupCache.4.little", cAlternateFileName="STARTU~1.LIT")) returned 0 [0040.979] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.979] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa424e390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa424e390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e342e65, dwReserved1=0x7474696c, cFileName="thumbnails", cAlternateFileName="THUMBN~1")) returned 1 [0040.979] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.980] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.980] CryptHashData (hHash=0x5c90c0, pbData=0x33e1d30, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.980] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0040.980] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0040.980] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ac8, pdwDataLen=0x18ea70) returned 0 [0040.980] GetLastError () returned 0xea [0040.980] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ac8*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ac8*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.980] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.981] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.982] SetEndOfFile (hFile=0x114) returned 1 [0040.982] CloseHandle (hObject=0x114) returned 1 [0040.982] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.982] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.982] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8ea04f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ea04f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.982] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb653ec30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8ea04f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ea04f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.982] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa42020d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa42020d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa42020d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="4cc87c1409819bf06f42b782d4902b2f.png.crypt", cAlternateFileName="4CC87C~1.CRY")) returned 1 [0040.982] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa42020d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa42020d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4228230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x40b0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ba182bcd131f1f3c6b6fbbb1ba078341.png.crypt", cAlternateFileName="BA182B~1.CRY")) returned 1 [0040.982] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4228230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4228230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa424e390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1c362, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ce8c0453589216a67cddb50284fbfe8d.png.crypt", cAlternateFileName="CE8C04~1.CRY")) returned 1 [0040.982] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ea04f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ea04f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ea04f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.982] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ea04f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ea04f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ea04f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.982] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.982] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 1 [0040.982] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb64f2970, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb64f2970, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853a9e10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_CACHE_CLEAN_", cAlternateFileName="_CACHE~1")) returned 0 [0040.982] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.982] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x826e2030, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x826e2030, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0040.983] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.983] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Profiles", cAlternateFileName="")) returned 0 [0040.983] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0040.983] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8c65050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8c65050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8c65050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.983] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="updates", cAlternateFileName="")) returned 1 [0040.983] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.983] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.983] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.983] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c91c0) returned 1 [0040.983] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.983] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20c8*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e20c8, pdwDataLen=0x18f1a8) returned 0 [0040.983] GetLastError () returned 0xea [0040.983] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20c8*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e20c8*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0040.984] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0040.984] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0040.985] SetEndOfFile (hFile=0xe8) returned 1 [0040.985] CloseHandle (hObject=0xe8) returned 1 [0040.985] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.985] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8ea04f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ea04f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.985] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8ea04f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ea04f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.985] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x854b47b0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x854b47b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="E7CF176E110C211B", cAlternateFileName="E7CF17~1")) returned 1 [0040.985] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0040.986] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0040.986] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.986] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9140) returned 1 [0040.986] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.986] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ab4*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1ab4, pdwDataLen=0x18ef40) returned 0 [0040.986] GetLastError () returned 0xea [0040.986] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1ab4*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1ab4*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0040.986] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0040.987] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.988] SetEndOfFile (hFile=0xf0) returned 1 [0040.988] CloseHandle (hObject=0xf0) returned 1 [0040.988] CryptDestroyKey (hKey=0x5c9140) returned 1 [0040.989] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.989] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8ea04f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ea04f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0040.989] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8ea04f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ea04f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.989] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a2b6d0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85442390, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85442390, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="active-update.xml", cAlternateFileName="ACTIVE~1.XML")) returned 1 [0040.989] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ea04f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ea04f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ea04f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.989] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb74b7b30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb74b7b30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="updates", cAlternateFileName="")) returned 1 [0040.989] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0040.989] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0040.989] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.989] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9100) returned 1 [0040.989] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.989] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18ecd8) returned 0 [0040.989] GetLastError () returned 0xea [0040.990] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0040.990] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0040.990] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0040.991] SetEndOfFile (hFile=0x108) returned 1 [0040.991] CloseHandle (hObject=0x108) returned 1 [0040.991] CryptDestroyKey (hKey=0x5c9100) returned 1 [0040.991] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.991] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0040.992] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.992] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80a2b6d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80a2b6d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0", cAlternateFileName="")) returned 1 [0040.992] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0040.992] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0040.992] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.992] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c90c0) returned 1 [0040.992] CryptDestroyHash (hHash=0x5c9040) returned 1 [0040.992] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18ea70) returned 0 [0040.992] GetLastError () returned 0xea [0040.992] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0040.993] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0040.993] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0040.994] SetEndOfFile (hFile=0x114) returned 1 [0040.994] CloseHandle (hObject=0x114) returned 1 [0040.994] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0040.994] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.994] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0040.994] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb74b7b30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.995] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ec6650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.995] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7d7ec50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7d7ec50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x818016b0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x927c0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="update.mar", cAlternateFileName="")) returned 1 [0040.995] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 1 [0040.995] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80993150, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80993150, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80993150, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="update.status", cAlternateFileName="UPDATE~1.STA")) returned 0 [0040.995] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0040.995] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ec6650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20457375, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.995] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ec6650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20457375, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.995] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0040.995] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="updates.xml", cAlternateFileName="")) returned 1 [0040.995] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80a9daf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8548e650, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8548e650, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="updates.xml", cAlternateFileName="")) returned 0 [0040.995] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0040.995] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ea04f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ea04f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ea04f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0040.995] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ea04f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ea04f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ea04f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0040.995] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0040.995] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb7314c10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="updates", cAlternateFileName="")) returned 0 [0040.995] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0040.995] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa4332bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4332bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Temp", cAlternateFileName="")) returned 1 [0040.995] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0040.996] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0040.996] CryptHashData (hHash=0x5c9000, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.996] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c91c0) returned 1 [0040.996] CryptDestroyHash (hHash=0x5c9000) returned 1 [0040.996] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e0708, pdwDataLen=0x18f410) returned 0 [0040.996] GetLastError () returned 0xea [0040.996] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e0708*, pdwDataLen=0x18f40c*=0x260) returned 1 [0040.996] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0040.997] WriteFile (in: hFile=0xec, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0040.998] SetEndOfFile (hFile=0xec) returned 1 [0040.998] CloseHandle (hObject=0xec) returned 1 [0040.998] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0040.998] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0040.998] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0040.998] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0040.998] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x72832060, ftCreationTime.dwHighDateTime=0x1d4d344, ftLastAccessTime.dwLowDateTime=0xd2486720, ftLastAccessTime.dwHighDateTime=0x1d4c792, ftLastWriteTime.dwLowDateTime=0xd2486720, ftLastWriteTime.dwHighDateTime=0x1d4c792, nFileSizeHigh=0x0, nFileSizeLow=0xf07a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="-32ImSs.mp3", cAlternateFileName="")) returned 1 [0040.998] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1142ffd0, ftCreationTime.dwHighDateTime=0x1d4cb76, ftLastAccessTime.dwLowDateTime=0x38747c0, ftLastAccessTime.dwHighDateTime=0x1d4c860, ftLastWriteTime.dwLowDateTime=0x38747c0, ftLastWriteTime.dwHighDateTime=0x1d4c860, nFileSizeHigh=0x0, nFileSizeLow=0x3231, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="00rAXylRhtDO.mp3", cAlternateFileName="00RAXY~1.MP3")) returned 1 [0040.998] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x261b3900, ftCreationTime.dwHighDateTime=0x1d4d0c5, ftLastAccessTime.dwLowDateTime=0x718368a0, ftLastAccessTime.dwHighDateTime=0x1d4d09c, ftLastWriteTime.dwLowDateTime=0x718368a0, ftLastWriteTime.dwHighDateTime=0x1d4d09c, nFileSizeHigh=0x0, nFileSizeLow=0x87a9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="2hw08W4XHVfXRAj.m4a", cAlternateFileName="2HW08W~1.M4A")) returned 1 [0040.998] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa424e390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa424e390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa42744f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x18af0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5io4ykP_aTNSWq.png.crypt", cAlternateFileName="5IO4YK~1.CRY")) returned 1 [0040.998] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ef54a70, ftCreationTime.dwHighDateTime=0x1d4cde1, ftLastAccessTime.dwLowDateTime=0x25716090, ftLastAccessTime.dwHighDateTime=0x1d4d1da, ftLastWriteTime.dwLowDateTime=0x25716090, ftLastWriteTime.dwHighDateTime=0x1d4d1da, nFileSizeHigh=0x0, nFileSizeLow=0x4db8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="80cAS.mp4", cAlternateFileName="")) returned 1 [0040.998] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x578bf760, ftCreationTime.dwHighDateTime=0x1d4d087, ftLastAccessTime.dwLowDateTime=0x94a50eb0, ftLastAccessTime.dwHighDateTime=0x1d4cb7e, ftLastWriteTime.dwLowDateTime=0x94a50eb0, ftLastWriteTime.dwHighDateTime=0x1d4cb7e, nFileSizeHigh=0x0, nFileSizeLow=0x14694, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="A4g9WOPgcu6O9s.gif", cAlternateFileName="A4G9WO~1.GIF")) returned 1 [0040.998] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8426eba0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x8426eba0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x842e0fc0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1 [0040.998] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77c66ea0, ftCreationTime.dwHighDateTime=0x1d4c7dd, ftLastAccessTime.dwLowDateTime=0x3bba0980, ftLastAccessTime.dwHighDateTime=0x1d4d2d2, ftLastWriteTime.dwLowDateTime=0x3bba0980, ftLastWriteTime.dwHighDateTime=0x1d4d2d2, nFileSizeHigh=0x0, nFileSizeLow=0xf49f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="aKzVa3IxuqL1.mp4", cAlternateFileName="AKZVA3~1.MP4")) returned 1 [0040.999] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf04e3ec0, ftCreationTime.dwHighDateTime=0x1d4cb57, ftLastAccessTime.dwLowDateTime=0xbfa28410, ftLastAccessTime.dwHighDateTime=0x1d4d035, ftLastWriteTime.dwLowDateTime=0xbfa28410, ftLastWriteTime.dwHighDateTime=0x1d4d035, nFileSizeHigh=0x0, nFileSizeLow=0x1613, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cFYt2wQ.doc", cAlternateFileName="")) returned 1 [0040.999] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x15f72850, ftCreationTime.dwHighDateTime=0x1d4cb92, ftLastAccessTime.dwLowDateTime=0x1da270c0, ftLastAccessTime.dwHighDateTime=0x1d4c93d, ftLastWriteTime.dwLowDateTime=0x1da270c0, ftLastWriteTime.dwHighDateTime=0x1d4c93d, nFileSizeHigh=0x0, nFileSizeLow=0xee5d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cl_UFtg4iNDKobgiu9i_.mp4", cAlternateFileName="CL_UFT~1.MP4")) returned 1 [0040.999] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Cookies", cAlternateFileName="")) returned 1 [0040.999] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0040.999] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0040.999] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0040.999] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9140) returned 1 [0040.999] CryptDestroyHash (hHash=0x5c9000) returned 1 [0040.999] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0a64*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e0a64, pdwDataLen=0x18f1a8) returned 0 [0040.999] GetLastError () returned 0xea [0040.999] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0a64*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e0a64*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.000] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\cookies\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.000] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.001] SetEndOfFile (hFile=0xe8) returned 1 [0041.001] CloseHandle (hObject=0xe8) returned 1 [0041.001] CryptDestroyKey (hKey=0x5c9140) returned 1 [0041.001] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.001] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0041.002] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.002] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ec6650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.002] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0041.002] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 0 [0041.002] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0041.002] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8727a0c0, ftCreationTime.dwHighDateTime=0x1d4d3f0, ftLastAccessTime.dwLowDateTime=0x669ae950, ftLastAccessTime.dwHighDateTime=0x1d4cf3d, ftLastWriteTime.dwLowDateTime=0x669ae950, ftLastWriteTime.dwHighDateTime=0x1d4cf3d, nFileSizeHigh=0x0, nFileSizeLow=0x17439, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="FSO3fD2cQfhLURU.doc", cAlternateFileName="FSO3FD~1.DOC")) returned 1 [0041.002] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1 [0041.002] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa42744f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa42744f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa42744f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="FXSAPIDebugLogFile.txt.crypt", cAlternateFileName="FXSAPI~1.CRY")) returned 1 [0041.002] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa0317820, ftCreationTime.dwHighDateTime=0x1d4ca09, ftLastAccessTime.dwLowDateTime=0xc506dff0, ftLastAccessTime.dwHighDateTime=0x1d4c720, ftLastWriteTime.dwLowDateTime=0xc506dff0, ftLastWriteTime.dwHighDateTime=0x1d4c720, nFileSizeHigh=0x0, nFileSizeLow=0xfa05, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="GQKP.gif", cAlternateFileName="")) returned 1 [0041.002] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="History", cAlternateFileName="")) returned 1 [0041.002] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.003] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.003] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.003] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9000) returned 1 [0041.003] CryptDestroyHash (hHash=0x5c9140) returned 1 [0041.003] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e225c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e225c, pdwDataLen=0x18f1a8) returned 0 [0041.003] GetLastError () returned 0xea [0041.003] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e225c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e225c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.003] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.003] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.004] SetEndOfFile (hFile=0xe8) returned 1 [0041.004] CloseHandle (hObject=0xe8) returned 1 [0041.004] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.005] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.005] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.005] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.005] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa429a650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa429a650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0041.005] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.006] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.006] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.006] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0041.006] CryptDestroyHash (hHash=0x5c9140) returned 1 [0041.006] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1840*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1840, pdwDataLen=0x18ef40) returned 0 [0041.006] GetLastError () returned 0xea [0041.006] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1840*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1840*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.006] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\history\\history.ie5\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.007] WriteFile (in: hFile=0xf0, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.008] SetEndOfFile (hFile=0xf0) returned 1 [0041.008] CloseHandle (hObject=0xf0) returned 1 [0041.008] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.008] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.008] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.008] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.008] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa42744f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa42744f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa429a650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0041.008] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8eec7b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.008] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0041.008] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 0 [0041.008] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.008] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ec6650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.008] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ec6650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.008] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.008] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c2baa10, ftCreationTime.dwHighDateTime=0x1d4d1b3, ftLastAccessTime.dwLowDateTime=0x268a4cd0, ftLastAccessTime.dwHighDateTime=0x1d4c5b4, ftLastWriteTime.dwLowDateTime=0x268a4cd0, ftLastWriteTime.dwHighDateTime=0x1d4c5b4, nFileSizeHigh=0x0, nFileSizeLow=0x122bb, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HjJiUsvBzzT.mkv", cAlternateFileName="HJJIUS~1.MKV")) returned 1 [0041.008] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ec6650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ec6650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ec6650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.008] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b3c98b0, ftCreationTime.dwHighDateTime=0x1d4c982, ftLastAccessTime.dwLowDateTime=0x9297a5d0, ftLastAccessTime.dwHighDateTime=0x1d4d1fd, ftLastWriteTime.dwLowDateTime=0x9297a5d0, ftLastWriteTime.dwHighDateTime=0x1d4d1fd, nFileSizeHigh=0x0, nFileSizeLow=0xd4f6, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="iK-FSy.wav", cAlternateFileName="")) returned 1 [0041.008] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39602770, ftCreationTime.dwHighDateTime=0x1d4cbe1, ftLastAccessTime.dwLowDateTime=0xaff20ee0, ftLastAccessTime.dwHighDateTime=0x1d4d3d8, ftLastWriteTime.dwLowDateTime=0xaff20ee0, ftLastWriteTime.dwHighDateTime=0x1d4d3d8, nFileSizeHigh=0x0, nFileSizeLow=0xa8dc, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="jgMOzQNI.wav", cAlternateFileName="")) returned 1 [0041.008] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb3c67af0, ftCreationTime.dwHighDateTime=0x1d4c85d, ftLastAccessTime.dwLowDateTime=0x6ed57800, ftLastAccessTime.dwHighDateTime=0x1d4cd6d, ftLastWriteTime.dwLowDateTime=0x6ed57800, ftLastWriteTime.dwHighDateTime=0x1d4cd6d, nFileSizeHigh=0x0, nFileSizeLow=0x8a38, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="jriXj.m4a", cAlternateFileName="")) returned 1 [0041.009] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa429a650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa429a650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa429a650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7144, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="jtypR131TZE-LNfWN6F.jpg.crypt", cAlternateFileName="JTYPR1~1.CRY")) returned 1 [0041.009] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c5e4890, ftCreationTime.dwHighDateTime=0x1d4cd42, ftLastAccessTime.dwLowDateTime=0xd60b7490, ftLastAccessTime.dwHighDateTime=0x1d4d301, ftLastWriteTime.dwLowDateTime=0xd60b7490, ftLastWriteTime.dwHighDateTime=0x1d4d301, nFileSizeHigh=0x0, nFileSizeLow=0x12b1a, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="KlhcpCy_.ods", cAlternateFileName="")) returned 1 [0041.009] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43b1fc70, ftCreationTime.dwHighDateTime=0x1d4c958, ftLastAccessTime.dwLowDateTime=0xcc3fb580, ftLastAccessTime.dwHighDateTime=0x1d4cc34, ftLastWriteTime.dwLowDateTime=0xcc3fb580, ftLastWriteTime.dwHighDateTime=0x1d4cc34, nFileSizeHigh=0x0, nFileSizeLow=0x18c52, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="L4Mce_hTp5eSUCW.avi", cAlternateFileName="L4MCE_~1.AVI")) returned 1 [0041.009] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbba97d80, ftCreationTime.dwHighDateTime=0x1d4ce11, ftLastAccessTime.dwLowDateTime=0x132995a0, ftLastAccessTime.dwHighDateTime=0x1d4cf51, ftLastWriteTime.dwLowDateTime=0x132995a0, ftLastWriteTime.dwHighDateTime=0x1d4cf51, nFileSizeHigh=0x0, nFileSizeLow=0x15eff, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="N5uV0XPCzJXOHSAntFh7.xls", cAlternateFileName="N5UV0X~1.XLS")) returned 1 [0041.009] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9a1d550, ftCreationTime.dwHighDateTime=0x1d4cef6, ftLastAccessTime.dwLowDateTime=0xffdd66d0, ftLastAccessTime.dwHighDateTime=0x1d4cbc6, ftLastWriteTime.dwLowDateTime=0xffdd66d0, ftLastWriteTime.dwHighDateTime=0x1d4cbc6, nFileSizeHigh=0x0, nFileSizeLow=0x25fa, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="qKeV-bFPsfmfEIMA.gif", cAlternateFileName="QKEV-B~1.GIF")) returned 1 [0041.009] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2e6dab0, ftCreationTime.dwHighDateTime=0x1d4c7ec, ftLastAccessTime.dwLowDateTime=0x96896da0, ftLastAccessTime.dwHighDateTime=0x1d4c671, ftLastWriteTime.dwLowDateTime=0x96896da0, ftLastWriteTime.dwHighDateTime=0x1d4c671, nFileSizeHigh=0x0, nFileSizeLow=0x675f, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="S-GJZ6fQnIMuKjn4b.avi", cAlternateFileName="S-GJZ6~1.AVI")) returned 1 [0041.009] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28135610, ftCreationTime.dwHighDateTime=0x1d4ccc0, ftLastAccessTime.dwLowDateTime=0x5d84b150, ftLastAccessTime.dwHighDateTime=0x1d4ca62, ftLastWriteTime.dwLowDateTime=0x5d84b150, ftLastWriteTime.dwHighDateTime=0x1d4ca62, nFileSizeHigh=0x0, nFileSizeLow=0x9003, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="s8u20c35Qa.flv", cAlternateFileName="S8U20C~1.FLV")) returned 1 [0041.009] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbae45ee0, ftCreationTime.dwHighDateTime=0x1d4c765, ftLastAccessTime.dwLowDateTime=0x3903c350, ftLastAccessTime.dwHighDateTime=0x1d4c933, ftLastWriteTime.dwLowDateTime=0x3903c350, ftLastWriteTime.dwHighDateTime=0x1d4c933, nFileSizeHigh=0x0, nFileSizeLow=0x3c1b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="sk21AT-eeuEaN0Sf1o.gif", cAlternateFileName="SK21AT~1.GIF")) returned 1 [0041.009] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x985d0680, ftCreationTime.dwHighDateTime=0x1d4c871, ftLastAccessTime.dwLowDateTime=0x6008b920, ftLastAccessTime.dwHighDateTime=0x1d4cd4c, ftLastWriteTime.dwLowDateTime=0x6008b920, ftLastWriteTime.dwHighDateTime=0x1d4cd4c, nFileSizeHigh=0x0, nFileSizeLow=0xfc42, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="So0-9GY-M-NF.flv", cAlternateFileName="SO0-9G~1.FLV")) returned 1 [0041.009] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa429a650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa429a650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa42c07b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb924, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="t9hkZDKT6mmn.png.crypt", cAlternateFileName="T9HKZD~1.CRY")) returned 1 [0041.009] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0041.009] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.009] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.009] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.009] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0041.010] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.010] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e09b8*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e09b8, pdwDataLen=0x18f1a8) returned 0 [0041.010] GetLastError () returned 0xea [0041.010] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e09b8*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e09b8*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.010] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.010] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.011] SetEndOfFile (hFile=0xe8) returned 1 [0041.011] CloseHandle (hObject=0xe8) returned 1 [0041.011] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.011] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.011] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.011] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.012] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa42e6910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa42e6910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0041.012] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.012] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.012] CryptHashData (hHash=0x5c9000, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.012] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9140) returned 1 [0041.012] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.012] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2210*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2210, pdwDataLen=0x18ef40) returned 0 [0041.012] GetLastError () returned 0xea [0041.012] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2210*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2210*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.013] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.013] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.014] SetEndOfFile (hFile=0xf0) returned 1 [0041.014] CloseHandle (hObject=0xf0) returned 1 [0041.014] CryptDestroyKey (hKey=0x5c9140) returned 1 [0041.014] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.014] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0041.014] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.014] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa42e6910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa42e6910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="03J4UQW0", cAlternateFileName="")) returned 1 [0041.014] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.015] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.015] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.015] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c90c0) returned 1 [0041.015] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.015] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21f8*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e21f8, pdwDataLen=0x18ecd8) returned 0 [0041.015] GetLastError () returned 0xea [0041.015] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21f8*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e21f8*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.015] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.016] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.017] SetEndOfFile (hFile=0x108) returned 1 [0041.017] CloseHandle (hObject=0x108) returned 1 [0041.017] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.017] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.017] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.017] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.017] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa42c07b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa42c07b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa42e6910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0041.017] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8eec7b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.017] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8eec7b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.017] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0041.017] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa42e6910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa42e6910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa42e6910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0041.017] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8eec7b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.017] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="index.dat", cAlternateFileName="")) returned 1 [0041.017] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa42e6910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa42e6910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="KETAJP6D", cAlternateFileName="")) returned 1 [0041.017] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.018] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.018] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.018] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9000) returned 1 [0041.018] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0041.018] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21f8*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e21f8, pdwDataLen=0x18ecd8) returned 0 [0041.018] GetLastError () returned 0xea [0041.018] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21f8*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e21f8*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.018] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\ketajp6d\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.019] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.019] SetEndOfFile (hFile=0x108) returned 1 [0041.020] CloseHandle (hObject=0x108) returned 1 [0041.020] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.020] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.020] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.020] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.020] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa42e6910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa42e6910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa42e6910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0041.020] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8eec7b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.020] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8eec7b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.020] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.020] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa430ca70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa430ca70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="VB18B0KB", cAlternateFileName="")) returned 1 [0041.020] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.021] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.021] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.021] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c90c0) returned 1 [0041.021] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.021] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21f8*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e21f8, pdwDataLen=0x18ecd8) returned 0 [0041.021] GetLastError () returned 0xea [0041.021] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21f8*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e21f8*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.022] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.025] SetEndOfFile (hFile=0x108) returned 1 [0041.025] CloseHandle (hObject=0x108) returned 1 [0041.025] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.025] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.025] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.025] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.025] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa430ca70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa430ca70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa430ca70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0041.025] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f12910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.025] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f12910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.025] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0041.025] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa430ca70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa430ca70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1 [0041.025] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.026] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.026] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.026] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9000) returned 1 [0041.026] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0041.026] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21f8*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e21f8, pdwDataLen=0x18ecd8) returned 0 [0041.026] GetLastError () returned 0xea [0041.026] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21f8*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e21f8*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.027] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.027] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.028] SetEndOfFile (hFile=0x108) returned 1 [0041.028] CloseHandle (hObject=0x108) returned 1 [0041.028] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.028] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.028] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.028] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.028] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa430ca70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa430ca70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa430ca70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0041.028] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f12910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.028] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f12910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.028] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.029] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa430ca70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa430ca70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0 [0041.029] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0041.029] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8eec7b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.029] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8eec7b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8eec7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8eec7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.029] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.029] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b865010, ftCreationTime.dwHighDateTime=0x1d4c954, ftLastAccessTime.dwLowDateTime=0x21f0cbf0, ftLastAccessTime.dwHighDateTime=0x1d4ced2, ftLastWriteTime.dwLowDateTime=0x21f0cbf0, ftLastWriteTime.dwHighDateTime=0x1d4ced2, nFileSizeHigh=0x0, nFileSizeLow=0x804a, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UfqKiEkYuwI93_-.swf", cAlternateFileName="UFQKIE~1.SWF")) returned 1 [0041.029] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe44454c0, ftCreationTime.dwHighDateTime=0x1d4cfe9, ftLastAccessTime.dwLowDateTime=0xb199df20, ftLastAccessTime.dwHighDateTime=0x1d4ca9b, ftLastWriteTime.dwLowDateTime=0xb199df20, ftLastWriteTime.dwHighDateTime=0x1d4ca9b, nFileSizeHigh=0x0, nFileSizeLow=0xb932, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UgBzhl2WTYR9ESx_sq.m4a", cAlternateFileName="UGBZHL~1.M4A")) returned 1 [0041.029] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a1f0640, ftCreationTime.dwHighDateTime=0x1d4c9ee, ftLastAccessTime.dwLowDateTime=0x68ed4c00, ftLastAccessTime.dwHighDateTime=0x1d4d2e6, ftLastWriteTime.dwLowDateTime=0x68ed4c00, ftLastWriteTime.dwHighDateTime=0x1d4d2e6, nFileSizeHigh=0x0, nFileSizeLow=0x174d0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="uMHSWgHojvs17aqvFAe4.odp", cAlternateFileName="UMHSWG~1.ODP")) returned 1 [0041.029] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5829c3e0, ftCreationTime.dwHighDateTime=0x1d4c809, ftLastAccessTime.dwLowDateTime=0xc39a2c70, ftLastAccessTime.dwHighDateTime=0x1d4d509, ftLastWriteTime.dwLowDateTime=0xc39a2c70, ftLastWriteTime.dwHighDateTime=0x1d4d509, nFileSizeHigh=0x0, nFileSizeLow=0x93b5, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="uNI3bAqcyPO.rtf", cAlternateFileName="UNI3BA~1.RTF")) returned 1 [0041.029] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4ff7a30, ftCreationTime.dwHighDateTime=0x1d4d164, ftLastAccessTime.dwLowDateTime=0x76e24df0, ftLastAccessTime.dwHighDateTime=0x1d4cfe5, ftLastWriteTime.dwLowDateTime=0x76e24df0, ftLastWriteTime.dwHighDateTime=0x1d4cfe5, nFileSizeHigh=0x0, nFileSizeLow=0x32be, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Vn1iq4oO4_DCn0Pz.gif", cAlternateFileName="VN1IQ4~1.GIF")) returned 1 [0041.029] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9d37abf0, ftCreationTime.dwHighDateTime=0x1d4c5de, ftLastAccessTime.dwLowDateTime=0x8fcbe9d0, ftLastAccessTime.dwHighDateTime=0x1d4d188, ftLastWriteTime.dwLowDateTime=0x8fcbe9d0, ftLastWriteTime.dwHighDateTime=0x1d4d188, nFileSizeHigh=0x0, nFileSizeLow=0xd74e, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="vnCsY2p-T0nHBKZ8D19.mp3", cAlternateFileName="VNCSY2~1.MP3")) returned 1 [0041.029] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x874c95a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x874c95a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="WPDNSE", cAlternateFileName="")) returned 1 [0041.029] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.030] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.030] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.030] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9140) returned 1 [0041.030] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.030] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1840*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1840, pdwDataLen=0x18f1a8) returned 0 [0041.030] GetLastError () returned 0xea [0041.030] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1840*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1840*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.030] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\wpdnse\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.031] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.031] SetEndOfFile (hFile=0xe8) returned 1 [0041.032] CloseHandle (hObject=0xe8) returned 1 [0041.032] CryptDestroyKey (hKey=0x5c9140) returned 1 [0041.032] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.032] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0041.032] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.032] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f12910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.032] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f12910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.032] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0041.032] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa430ca70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa430ca70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4332bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6faf, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="xm4-N-lSG2Dlt0AN.png.crypt", cAlternateFileName="XM4-N-~1.CRY")) returned 1 [0041.032] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbebb9c90, ftCreationTime.dwHighDateTime=0x1d4c61b, ftLastAccessTime.dwLowDateTime=0x57482b60, ftLastAccessTime.dwHighDateTime=0x1d4d1aa, ftLastWriteTime.dwLowDateTime=0x57482b60, ftLastWriteTime.dwHighDateTime=0x1d4d1aa, nFileSizeHigh=0x0, nFileSizeLow=0x30a8, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Xwvd.flv", cAlternateFileName="")) returned 1 [0041.032] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbebb9c90, ftCreationTime.dwHighDateTime=0x1d4c61b, ftLastAccessTime.dwLowDateTime=0x57482b60, ftLastAccessTime.dwHighDateTime=0x1d4d1aa, ftLastWriteTime.dwLowDateTime=0x57482b60, ftLastWriteTime.dwHighDateTime=0x1d4d1aa, nFileSizeHigh=0x0, nFileSizeLow=0x30a8, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Xwvd.flv", cAlternateFileName="")) returned 0 [0041.032] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0041.032] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6e702e4e, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0041.032] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0041.033] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0041.033] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.033] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9140) returned 1 [0041.033] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0041.033] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18f410) returned 0 [0041.033] GetLastError () returned 0xea [0041.033] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f40c*=0x260) returned 1 [0041.034] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temporary internet files\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0041.034] WriteFile (in: hFile=0xec, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0041.034] SetEndOfFile (hFile=0xec) returned 1 [0041.034] CloseHandle (hObject=0xec) returned 1 [0041.034] CryptDestroyKey (hKey=0x5c9140) returned 1 [0041.034] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.034] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f3a4, ftLastWriteTime.dwHighDateTime=0x18f3a0, nFileSizeHigh=0x18f3e8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x8f\x5c")) returned 0xffffffff [0041.034] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0041.034] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0041.035] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0041.035] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.035] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c91c0) returned 1 [0041.035] CryptDestroyHash (hHash=0x5c9140) returned 1 [0041.035] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21f0*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e21f0, pdwDataLen=0x18f410) returned 0 [0041.035] GetLastError () returned 0xea [0041.035] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e21f0*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e21f0*, pdwDataLen=0x18f40c*=0x260) returned 1 [0041.035] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\virtualstore\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0041.036] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0041.037] SetEndOfFile (hFile=0xec) returned 1 [0041.037] CloseHandle (hObject=0xec) returned 1 [0041.037] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0041.037] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.037] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0041.037] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f12910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.037] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f12910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.037] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f12910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f12910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.038] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0041.038] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0041.038] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.038] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0041.038] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0041.038] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0041.038] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.038] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c91c0) returned 1 [0041.038] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.038] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e156c*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e156c, pdwDataLen=0x18f678) returned 0 [0041.038] GetLastError () returned 0xea [0041.038] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e156c*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e156c*, pdwDataLen=0x18f674*=0x260) returned 1 [0041.039] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.039] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0041.040] SetEndOfFile (hFile=0xf8) returned 1 [0041.040] CloseHandle (hObject=0xf8) returned 1 [0041.040] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0041.040] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.040] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8f38a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0041.040] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8f38a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.040] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Adobe", cAlternateFileName="")) returned 1 [0041.040] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0041.041] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0041.041] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.041] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9140) returned 1 [0041.041] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.041] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f410) returned 0 [0041.041] GetLastError () returned 0xea [0041.041] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f40c*=0x260) returned 1 [0041.041] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0041.042] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0041.043] SetEndOfFile (hFile=0xec) returned 1 [0041.043] CloseHandle (hObject=0xec) returned 1 [0041.043] CryptDestroyKey (hKey=0x5c9140) returned 1 [0041.043] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.043] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f38a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0041.043] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f38a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.043] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0041.043] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.044] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.044] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.044] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0041.044] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.044] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0978*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e0978, pdwDataLen=0x18f1a8) returned 0 [0041.044] GetLastError () returned 0xea [0041.044] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0978*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e0978*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.044] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.044] WriteFile (in: hFile=0xe8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.045] SetEndOfFile (hFile=0xe8) returned 1 [0041.045] CloseHandle (hObject=0xe8) returned 1 [0041.045] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.045] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.046] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f38a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.046] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f38a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.046] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="10.0", cAlternateFileName="")) returned 1 [0041.046] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.046] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.046] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.046] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9000) returned 1 [0041.046] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.046] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18ef40) returned 0 [0041.046] GetLastError () returned 0xea [0041.046] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.047] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.057] WriteFile (in: hFile=0xf0, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.061] SetEndOfFile (hFile=0xf0) returned 1 [0041.061] CloseHandle (hObject=0xf0) returned 1 [0041.061] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.061] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.061] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f38a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.061] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f38a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.062] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f38a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f38a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f5ebd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.062] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1 [0041.062] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce824760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce824760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe5ab8070, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1 [0041.062] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Search", cAlternateFileName="")) returned 1 [0041.062] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.062] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.062] CryptHashData (hHash=0x5c8fc0, pbData=0x1fc6440, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.062] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c90c0) returned 1 [0041.062] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.062] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18ecd8) returned 0 [0041.062] GetLastError () returned 0xea [0041.062] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.063] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\search\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.063] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.064] SetEndOfFile (hFile=0x108) returned 1 [0041.064] CloseHandle (hObject=0x108) returned 1 [0041.064] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.064] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.064] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8f5ebd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f5ebd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.064] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8f5ebd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f5ebd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.065] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f5ebd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f5ebd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f5ebd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.065] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f5ebd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f5ebd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f5ebd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.065] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0041.065] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Search", cAlternateFileName="")) returned 0 [0041.065] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.065] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f38a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f38a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20736567, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.065] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f38a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f38a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20736567, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.065] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.065] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f38a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f38a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.065] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0041.065] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.066] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.066] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.066] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9000) returned 1 [0041.066] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.066] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e122c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e122c, pdwDataLen=0x18f1a8) returned 0 [0041.066] GetLastError () returned 0xea [0041.066] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e122c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e122c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.066] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.067] SetEndOfFile (hFile=0xe8) returned 1 [0041.067] CloseHandle (hObject=0xe8) returned 1 [0041.067] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.067] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.067] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f5ebd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f5ebd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.067] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f5ebd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f5ebd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.068] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0041.068] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.068] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.068] CryptHashData (hHash=0x5c9100, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.068] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c90c0) returned 1 [0041.068] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.068] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18ef40) returned 0 [0041.068] GetLastError () returned 0xea [0041.068] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.069] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.069] WriteFile (in: hFile=0xf0, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.070] SetEndOfFile (hFile=0xf0) returned 1 [0041.070] CloseHandle (hObject=0xf0) returned 1 [0041.070] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.070] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.070] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.070] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.070] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0041.070] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.071] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.071] CryptHashData (hHash=0x5c9100, pbData=0x33e11ac, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.071] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8fc0) returned 1 [0041.071] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.071] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0f44*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e0f44, pdwDataLen=0x18ecd8) returned 0 [0041.071] GetLastError () returned 0xea [0041.071] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0f44*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e0f44*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.071] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.072] WriteFile (in: hFile=0x108, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.073] SetEndOfFile (hFile=0x108) returned 1 [0041.073] CloseHandle (hObject=0x108) returned 1 [0041.073] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.073] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.074] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.074] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.074] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="all", cAlternateFileName="")) returned 1 [0041.074] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.074] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.074] CryptHashData (hHash=0x5c9100, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.074] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0041.074] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.074] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18ea70) returned 0 [0041.074] GetLastError () returned 0xea [0041.074] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.075] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\all\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.075] WriteFile (in: hFile=0x114, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.076] SetEndOfFile (hFile=0x114) returned 1 [0041.076] CloseHandle (hObject=0x114) returned 1 [0041.076] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.076] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.076] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.077] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.077] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f84d30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.077] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f84d30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.077] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.077] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="brt", cAlternateFileName="")) returned 1 [0041.077] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.077] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.077] CryptHashData (hHash=0x5c9040, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.077] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0041.077] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.077] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e227c, pdwDataLen=0x18ea70) returned 0 [0041.077] GetLastError () returned 0xea [0041.078] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.078] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.078] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.079] SetEndOfFile (hFile=0x114) returned 1 [0041.079] CloseHandle (hObject=0x114) returned 1 [0041.079] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.079] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.080] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.080] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f84d30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.080] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f84d30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.080] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.080] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="brz", cAlternateFileName="")) returned 1 [0041.080] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.080] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.080] CryptHashData (hHash=0x5c9100, pbData=0x33e0eac, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.080] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0041.080] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.080] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e227c, pdwDataLen=0x18ea70) returned 0 [0041.080] GetLastError () returned 0xea [0041.080] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.081] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brz\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.081] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.083] SetEndOfFile (hFile=0x114) returned 1 [0041.083] CloseHandle (hObject=0x114) returned 1 [0041.083] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.083] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.083] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.083] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.083] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f84d30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.083] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f84d30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.083] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.083] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="dan", cAlternateFileName="")) returned 1 [0041.083] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.084] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.084] CryptHashData (hHash=0x5c9040, pbData=0x211c14, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.084] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0041.084] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.084] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e227c, pdwDataLen=0x18ea70) returned 0 [0041.084] GetLastError () returned 0xea [0041.084] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.084] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dan\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.085] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.086] SetEndOfFile (hFile=0x114) returned 1 [0041.086] CloseHandle (hObject=0x114) returned 1 [0041.086] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.086] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.086] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.086] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.086] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8faae90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.086] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8faae90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.087] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.087] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="dut", cAlternateFileName="")) returned 1 [0041.087] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.087] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.087] CryptHashData (hHash=0x5c9100, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.087] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0041.087] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.087] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e227c, pdwDataLen=0x18ea70) returned 0 [0041.087] GetLastError () returned 0xea [0041.087] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.088] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dut\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.088] WriteFile (in: hFile=0x114, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.089] SetEndOfFile (hFile=0x114) returned 1 [0041.089] CloseHandle (hObject=0x114) returned 1 [0041.089] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.089] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.089] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.089] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.090] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8faae90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.090] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8faae90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.090] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.090] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="eng", cAlternateFileName="")) returned 1 [0041.090] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.090] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.090] CryptHashData (hHash=0x5c9040, pbData=0x33e10fc, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.090] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0041.090] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.090] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e227c, pdwDataLen=0x18ea70) returned 0 [0041.090] GetLastError () returned 0xea [0041.090] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.091] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\eng\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.091] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.092] SetEndOfFile (hFile=0x114) returned 1 [0041.092] CloseHandle (hObject=0x114) returned 1 [0041.092] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.092] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.092] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.093] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.093] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8faae90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.093] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8faae90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.093] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.093] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="frn", cAlternateFileName="")) returned 1 [0041.093] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.093] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.093] CryptHashData (hHash=0x5c9100, pbData=0x1f65080, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.093] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0041.093] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.093] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e227c, pdwDataLen=0x18ea70) returned 0 [0041.093] GetLastError () returned 0xea [0041.093] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.094] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\frn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.094] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.095] SetEndOfFile (hFile=0x114) returned 1 [0041.095] CloseHandle (hObject=0x114) returned 1 [0041.095] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.095] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.095] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.096] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.096] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8faae90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.096] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8faae90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.096] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.096] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="grm", cAlternateFileName="")) returned 1 [0041.096] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.096] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.096] CryptHashData (hHash=0x5c9040, pbData=0x211c14, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.096] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0041.096] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.096] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e227c, pdwDataLen=0x18ea70) returned 0 [0041.096] GetLastError () returned 0xea [0041.096] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.097] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\grm\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.097] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.098] SetEndOfFile (hFile=0x114) returned 1 [0041.098] CloseHandle (hObject=0x114) returned 1 [0041.098] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.098] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.098] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.099] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.099] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8faae90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.099] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8faae90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8faae90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8faae90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.099] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.099] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f84d30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.099] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="itl", cAlternateFileName="")) returned 1 [0041.099] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.101] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.101] CryptHashData (hHash=0x5c9100, pbData=0x298a44, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.101] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0041.101] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.101] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e227c, pdwDataLen=0x18ea70) returned 0 [0041.101] GetLastError () returned 0xea [0041.101] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.101] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\itl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.102] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.102] SetEndOfFile (hFile=0x114) returned 1 [0041.103] CloseHandle (hObject=0x114) returned 1 [0041.103] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.103] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.103] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.103] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.103] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8fd0ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.103] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8fd0ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.103] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.103] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="nrw", cAlternateFileName="")) returned 1 [0041.103] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.104] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.104] CryptHashData (hHash=0x5c9040, pbData=0x33e0f44, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.104] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0041.104] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.104] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e227c, pdwDataLen=0x18ea70) returned 0 [0041.104] GetLastError () returned 0xea [0041.104] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.104] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\nrw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.105] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.105] SetEndOfFile (hFile=0x114) returned 1 [0041.106] CloseHandle (hObject=0x114) returned 1 [0041.106] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.106] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.106] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.106] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.106] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8fd0ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.106] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8fd0ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.106] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.106] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="prt", cAlternateFileName="")) returned 1 [0041.106] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.107] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.107] CryptHashData (hHash=0x5c9100, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.107] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0041.107] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.107] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e227c, pdwDataLen=0x18ea70) returned 0 [0041.107] GetLastError () returned 0xea [0041.107] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.107] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\prt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.107] WriteFile (in: hFile=0x114, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.108] SetEndOfFile (hFile=0x114) returned 1 [0041.108] CloseHandle (hObject=0x114) returned 1 [0041.109] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.109] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.109] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.109] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.109] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8fd0ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.109] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8fd0ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.109] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.109] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="spn", cAlternateFileName="")) returned 1 [0041.109] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.110] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.110] CryptHashData (hHash=0x5c9040, pbData=0x33e0f64, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.110] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0041.110] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.110] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e227c, pdwDataLen=0x18ea70) returned 0 [0041.110] GetLastError () returned 0xea [0041.110] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.110] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\spn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.110] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.112] SetEndOfFile (hFile=0x114) returned 1 [0041.112] CloseHandle (hObject=0x114) returned 1 [0041.112] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.112] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.112] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.112] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.112] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8fd0ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.112] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8fd0ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.112] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.112] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="swd", cAlternateFileName="")) returned 1 [0041.112] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.113] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.113] CryptHashData (hHash=0x5c9100, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.113] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0041.113] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.113] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e227c, pdwDataLen=0x18ea70) returned 0 [0041.113] GetLastError () returned 0xea [0041.113] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e227c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.113] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\swd\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.114] WriteFile (in: hFile=0x114, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.115] SetEndOfFile (hFile=0x114) returned 1 [0041.115] CloseHandle (hObject=0x114) returned 1 [0041.115] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.115] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.115] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.115] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8fd0ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.115] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8fd0ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.115] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8fd0ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8fd0ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.115] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.115] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="swd", cAlternateFileName="")) returned 0 [0041.115] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.116] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f84d30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.116] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f84d30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f84d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f84d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.116] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0041.116] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f5ebd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f5ebd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f5ebd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.116] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f5ebd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f5ebd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f5ebd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.116] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.116] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0041.116] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0041.116] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8f38a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8f38a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8f38a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.116] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0041.116] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0041.116] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0041.117] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.117] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9000) returned 1 [0041.117] CryptDestroyHash (hHash=0x5c9140) returned 1 [0041.117] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0efc*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e0efc, pdwDataLen=0x18f410) returned 0 [0041.117] GetLastError () returned 0xea [0041.117] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0efc*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e0efc*, pdwDataLen=0x18f40c*=0x260) returned 1 [0041.117] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0041.117] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0041.118] SetEndOfFile (hFile=0xec) returned 1 [0041.118] CloseHandle (hObject=0xec) returned 1 [0041.118] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.118] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.118] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.119] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.119] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0041.119] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.119] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.119] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.119] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0041.119] CryptDestroyHash (hHash=0x5c9140) returned 1 [0041.119] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2274*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2274, pdwDataLen=0x18f1a8) returned 0 [0041.119] GetLastError () returned 0xea [0041.119] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2274*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2274*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.120] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.120] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.121] SetEndOfFile (hFile=0xe8) returned 1 [0041.121] CloseHandle (hObject=0xe8) returned 1 [0041.121] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.121] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.121] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.121] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.121] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Content", cAlternateFileName="")) returned 1 [0041.121] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.122] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.122] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.122] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0041.122] CryptDestroyHash (hHash=0x5c9140) returned 1 [0041.122] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2254*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2254, pdwDataLen=0x18ef40) returned 0 [0041.122] GetLastError () returned 0xea [0041.122] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2254*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2254*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.122] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.123] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.124] SetEndOfFile (hFile=0xf0) returned 1 [0041.124] CloseHandle (hObject=0xf0) returned 1 [0041.124] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.124] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.124] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x561, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xf1d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd0e4c510, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61210960, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61210960, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58394060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58394060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbddd270, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd2da, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x652, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x6e3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x663, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x64b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ff7150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ff7150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.126] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ff7150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MetaData", cAlternateFileName="")) returned 1 [0041.126] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.127] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.127] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.127] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9140) returned 1 [0041.127] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.127] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2254*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2254, pdwDataLen=0x18ef40) returned 0 [0041.127] GetLastError () returned 0xea [0041.127] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2254*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2254*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.127] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.128] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.128] SetEndOfFile (hFile=0xf0) returned 1 [0041.129] CloseHandle (hObject=0xf0) returned 1 [0041.129] CryptDestroyKey (hKey=0x5c9140) returned 1 [0041.129] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.129] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf9eaad0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf9eaad0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf9eaad0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B", cAlternateFileName="024823~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bd8410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bd8410, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe98d390, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x166, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875", cAlternateFileName="0F1583~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf952550, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf952550, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf952550, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973", cAlternateFileName="1BB09B~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4c00edb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4c00edb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4c00edb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1DAF2884EC4DFA96BA4A58D4DBC9C406", cAlternateFileName="1DAF28~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x580eb5c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x580eb5c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaedd4300, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="23B523C9E7746F715D33C6527C18EB9D", cAlternateFileName="23B523~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xc3791460, ftCreationTime.dwHighDateTime=0x1d2e675, ftLastAccessTime.dwLowDateTime=0xc3791460, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xc3791460, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53fdc930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53fdc930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf16fc70, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D", cAlternateFileName="3388EC~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53b19d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53b19d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54583d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="40E450F7CE13419A2CCC2A5445035A0A_06F02B1F13AB4B11B8FC669BDE565AF1", cAlternateFileName="40E450~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54537ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54537ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae76e7e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="4C8F841FB02DEC8C10108028DB86A08D_8DAFFFD2D43BDC7A1717F5B61C303398", cAlternateFileName="4C8F84~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7295ee20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7295ee20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xadfb2060, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9", cAlternateFileName="4DD397~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf8b9fd0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf8b9fd0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf8b9fd0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5080DC7A65DB6A5960ECD874088F3328_2908F682DFC81A793BD240CF29711C77", cAlternateFileName="5080DC~2")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf86dd10, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf86dd10, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf86dd10, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220", cAlternateFileName="5080DC~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf7af630, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4", cAlternateFileName="5457A8~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xed9b0820, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xed9b0820, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xed9b0820, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf763370, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf763370, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf763370, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="705A76DE71EA2CAEBB8F0907449CE086_9752C5B2D53EE7A19F7764B52968EC21", cAlternateFileName="705A76~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedb2d5e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedb2d5e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedb2d5e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x312640, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x1b2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6", cAlternateFileName="7423F8~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd48e2bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0041.129] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b2324c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b2324c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b2324c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7B8944BA8AD0EFDF0E01A43EF62BECD0_B2DB1CC4B5F2D2A802D56AAED525802D", cAlternateFileName="7B8944~1")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6b199f40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x6b199f40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x6b199f40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6", cAlternateFileName="7D266D~2")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefaf7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefaf7160, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaec313e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD", cAlternateFileName="7D266D~1")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6056b480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6056b480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1ef687a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_234CB5D64705D4DBB4DA839716359AF0", cAlternateFileName="8059E9~3")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x611ea800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x611ea800, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaecc9960, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_294110D6990EE392327F8A606D55BC1E", cAlternateFileName="80273C~1")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x58e24200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x58e24200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9f5f40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_50167909FCFE0C66153F1901439CBBA1", cAlternateFileName="8059E9~2")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61236ac0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61236ac0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3b0b01a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_581C904DB5924E46A6C1A8637614A40E", cAlternateFileName="809279~1")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5836df00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5836df00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f739c0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_5EA65844B9EF5670A9C002CBD85B10A4", cAlternateFileName="8059E9~1")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62378a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x62378a40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae9a9c80, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_74E943F7DAB6D19E37E4854057155778", cAlternateFileName="80E4BE~1")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x613675c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x613675c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69bba4a0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_C080DA2AE431C1A7F3B0C147EEB043ED", cAlternateFileName="803B9E~1")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x63c50fe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63c50fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb100bf40, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_E907D7A04657714B5B06D18BC920971E", cAlternateFileName="803D37~1")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x61021780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61021780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb1058200, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F2318F7AB33980A131A265454C39CA30", cAlternateFileName="8059E9~4")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x636a9ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x636a9ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb139e040, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8059E9A0D314877E40FE93D8CCFB3C69_F6E15778DC8E326895C606FBFA0392EB", cAlternateFileName="800D31~1")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x581f7ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x581f7ea0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f4d860, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="828298824EA5549947C17DDABF6871F5_0206EFBC540300C3BF0163CDBC3D7D56", cAlternateFileName="828298~1")) returned 1 [0041.130] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xec3c5340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec3c5340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xb16257a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F", cAlternateFileName="8828F3~1")) returned 1 [0041.131] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x8064ac00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x8064ac00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80670d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8828F39C7C0CE9A14B25C7EB321181BA_C6EF73E4482B2588B1252D1A64B99416", cAlternateFileName="8828F3~2")) returned 1 [0041.131] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6aa2c0a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6aa2c0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xadf19ae0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61", cAlternateFileName="8E4E51~1")) returned 1 [0041.131] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbf0dd70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0041.131] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6a83cec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a83cec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaebe5120, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9", cAlternateFileName="955CAB~1")) returned 1 [0041.131] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf3f73d0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf3f73d0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf3f73d0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="9BC2FFC5D9591E1BD3545230E9B7CC36_CF30943571F9BEE96C487B2D9F0436E6", cAlternateFileName="9BC2FF~1")) returned 1 [0041.131] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe06277d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe06277d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xb15d94e0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_1213DC6F71E4C3B05E7BCEEBC203A31E", cAlternateFileName="9C888B~1")) returned 1 [0041.131] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe07ca6f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe07ca6f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x965accc0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="9C888BEABCCBC2A97B0D6D9214C3BA37_EBC75728C6119A77E4DA8559DD10F061", cAlternateFileName="9C888B~2")) returned 1 [0041.131] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54bc3730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54bc3730, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb11d4fc0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1ae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="A9E4F776657345B52012CE8E279D314C_183A5BE0B233CC1D513955FABECF9450", cAlternateFileName="A9E4F7~1")) returned 1 [0041.131] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x53bfe570, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53bfe570, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbe9b34f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001", cAlternateFileName="ACF244~1")) returned 1 [0041.131] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe04aaa10, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe04aaa10, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xae4e7080, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_6F0A84CE2BA99BD19D42C92610275852", cAlternateFileName="B3BB9C~2")) returned 1 [0041.131] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xefc01b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xefc01b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xaa4ee1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="B3BB9C1BA2D19E090AE305B2683903A0_B89A63AC6877BD1ED812438CE82C3EB8", cAlternateFileName="B3BB9C~1")) returned 1 [0041.131] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x54322770, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54322770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_6CE6E578B5C8485B4BE3C4D58E12F150", cAlternateFileName="BC570E~2")) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x540c1170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x540c1170, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf019010, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BC570EC0DE58335AFAF92FDC8E3AA330_F4D449CA9E0EACCFE15946F8FCD349FC", cAlternateFileName="BC570E~1")) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x56bb3b80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x56bb3b80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaeca3800, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873", cAlternateFileName="C46E7B~2")) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x682fbd00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x682fbd00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xae0bca00, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE", cAlternateFileName="C46E7B~3")) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5461c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5461c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbf67eb30, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF", cAlternateFileName="C46E7B~1")) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x728c68a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x728c68a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xae63dce0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x194, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_4DD1053BCC726DA41115FFF4C7D6E9CC", cAlternateFileName="D47DBD~2")) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x545f6190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x545f6190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x69b6e1e0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE", cAlternateFileName="D47DBD~1")) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x808d4a70, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x808d4a70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x808d4a70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="D52C56D8F24BEC96604372AFBAF264E1_E76A2B627DD019EB51D9335F24B14C2C", cAlternateFileName="D52C56~1")) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x683e0540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x683e0540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xb0f015a0, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="EA618097E393409AFA316F0F87E2C202_827C1B837652B048C4C84237D0838585", cAlternateFileName="EA6180~1")) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xbf312b90, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf312b90, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xbf312b90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="F293AEAD5E84FACFB686C4A620718928_C8424A0B24A72939B13720D0C000C9C1", cAlternateFileName="F293AE~1")) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ff7150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ff7150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.132] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd0de60b0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0xd0de60b0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MetaData", cAlternateFileName="")) returned 0 [0041.132] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa8ff7150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa8ff7150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa8ff7150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.132] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IME12", cAlternateFileName="")) returned 1 [0041.132] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.133] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.133] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.133] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9140) returned 1 [0041.133] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0041.133] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2248, pdwDataLen=0x18f1a8) returned 0 [0041.133] GetLastError () returned 0xea [0041.133] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2248*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.133] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\ime12\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.134] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.134] SetEndOfFile (hFile=0xe8) returned 1 [0041.135] CloseHandle (hObject=0xe8) returned 1 [0041.135] CryptDestroyKey (hKey=0x5c9140) returned 1 [0041.135] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.135] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0041.135] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.135] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa901d2b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.135] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa901d2b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.135] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0041.135] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0041.135] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.136] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.136] CryptHashData (hHash=0x5c9140, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.136] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0041.136] CryptDestroyHash (hHash=0x5c9140) returned 1 [0041.136] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2234, pdwDataLen=0x18f1a8) returned 0 [0041.136] GetLastError () returned 0xea [0041.136] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2234*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.136] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\imjp12\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.137] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.137] SetEndOfFile (hFile=0xe8) returned 1 [0041.138] CloseHandle (hObject=0xe8) returned 1 [0041.138] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.138] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.138] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.138] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.138] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa901d2b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.138] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa901d2b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.138] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0041.138] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0041.138] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.139] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.139] CryptHashData (hHash=0x5c90c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.139] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9140) returned 1 [0041.139] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0041.139] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2234, pdwDataLen=0x18f1a8) returned 0 [0041.139] GetLastError () returned 0xea [0041.139] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2234*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.139] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\imjp8_1\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.140] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.141] SetEndOfFile (hFile=0xe8) returned 1 [0041.141] CloseHandle (hObject=0xe8) returned 1 [0041.141] CryptDestroyKey (hKey=0x5c9140) returned 1 [0041.141] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.141] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0041.141] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.141] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa901d2b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.141] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa901d2b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.141] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0041.141] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0041.141] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.142] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.142] CryptHashData (hHash=0x5c9140, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.142] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0041.142] CryptDestroyHash (hHash=0x5c9140) returned 1 [0041.142] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2234, pdwDataLen=0x18f1a8) returned 0 [0041.142] GetLastError () returned 0xea [0041.142] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2234*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.142] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\imjp9_0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.143] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.144] SetEndOfFile (hFile=0xe8) returned 1 [0041.144] CloseHandle (hObject=0xe8) returned 1 [0041.144] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.144] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.144] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.144] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.144] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa901d2b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.144] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa901d2b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.144] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0041.144] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0041.144] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.145] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.145] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.145] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9140) returned 1 [0041.145] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0041.145] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2234, pdwDataLen=0x18f1a8) returned 0 [0041.145] GetLastError () returned 0xea [0041.145] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2234*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.145] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.146] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.147] SetEndOfFile (hFile=0xe8) returned 1 [0041.147] CloseHandle (hObject=0xe8) returned 1 [0041.148] CryptDestroyKey (hKey=0x5c9140) returned 1 [0041.148] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.148] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0041.148] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa901d2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.148] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="DOMStore", cAlternateFileName="")) returned 1 [0041.148] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.148] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.148] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.148] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0041.149] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0041.149] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2234, pdwDataLen=0x18ef40) returned 0 [0041.149] GetLastError () returned 0xea [0041.149] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2234*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.149] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.151] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.152] SetEndOfFile (hFile=0xf0) returned 1 [0041.152] CloseHandle (hObject=0xf0) returned 1 [0041.152] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.152] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.152] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9043410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.152] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9043410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.152] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="36USA68T", cAlternateFileName="")) returned 1 [0041.152] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.153] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.153] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.153] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0041.153] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0041.153] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2234, pdwDataLen=0x18ecd8) returned 0 [0041.153] GetLastError () returned 0xea [0041.153] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2234*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.153] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.154] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.155] SetEndOfFile (hFile=0x108) returned 1 [0041.155] CloseHandle (hObject=0x108) returned 1 [0041.155] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.155] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.155] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9043410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.155] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9043410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.155] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9043410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9043410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.155] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 1 [0041.155] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b05050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b05050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b05050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="imagesrv.adition[1].xml", cAlternateFileName="IMAGES~1.XML")) returned 0 [0041.155] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.155] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x605dd8a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f697469, dwReserved1=0x5d315b6e, cFileName="3O75JDME", cAlternateFileName="")) returned 1 [0041.155] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.156] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.156] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.156] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c90c0) returned 1 [0041.156] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.156] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2234, pdwDataLen=0x18ecd8) returned 0 [0041.156] GetLastError () returned 0xea [0041.156] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2234*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.156] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.157] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.158] SetEndOfFile (hFile=0x108) returned 1 [0041.158] CloseHandle (hObject=0x108) returned 1 [0041.158] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.158] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.158] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9043410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.158] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9043410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.158] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9043410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9043410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.158] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 1 [0041.158] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x605dd8a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x605dd8a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x696aec80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="www.google[1].xml", cAlternateFileName="WWWGOO~1.XML")) returned 0 [0041.158] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0041.158] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9043410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9043410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x782e5d31, dwReserved1=0x52436c6d, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.158] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x782e5d31, dwReserved1=0x52436c6d, cFileName="index.dat", cAlternateFileName="")) returned 1 [0041.158] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x782e5d31, dwReserved1=0x52436c6d, cFileName="UV0DUWVB", cAlternateFileName="")) returned 1 [0041.158] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.159] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.159] CryptHashData (hHash=0x5c90c0, pbData=0x33e10c8, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.159] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0041.159] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0041.159] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2234, pdwDataLen=0x18ecd8) returned 0 [0041.159] GetLastError () returned 0xea [0041.159] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2234*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.160] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\uv0duwvb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.160] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.161] SetEndOfFile (hFile=0x108) returned 1 [0041.161] CloseHandle (hObject=0x108) returned 1 [0041.161] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.161] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.161] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9043410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.161] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9043410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.161] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9043410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9043410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.162] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9043410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9043410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.162] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.162] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="VGMTOI09", cAlternateFileName="")) returned 1 [0041.162] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.162] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.162] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.162] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c90c0) returned 1 [0041.162] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.162] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2234, pdwDataLen=0x18ecd8) returned 0 [0041.162] GetLastError () returned 0xea [0041.162] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2234*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.163] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.163] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.164] SetEndOfFile (hFile=0x108) returned 1 [0041.164] CloseHandle (hObject=0x108) returned 1 [0041.164] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.164] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.164] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.165] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.165] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9069570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.165] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 1 [0041.165] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52878dd0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="www.msn[1].xml", cAlternateFileName="WWWMSN~1.XML")) returned 0 [0041.165] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0041.165] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x510b3550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x510b3550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="VGMTOI09", cAlternateFileName="")) returned 0 [0041.165] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.165] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa901d2b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa901d2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9043410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.165] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Services", cAlternateFileName="")) returned 1 [0041.165] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.166] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.166] CryptHashData (hHash=0x5c8fc0, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.166] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c90c0) returned 1 [0041.166] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.166] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2234, pdwDataLen=0x18ef40) returned 0 [0041.166] GetLastError () returned 0xea [0041.166] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2234*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.166] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\services\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.167] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.167] SetEndOfFile (hFile=0xf0) returned 1 [0041.167] CloseHandle (hObject=0xf0) returned 1 [0041.168] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.168] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.168] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.168] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.168] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9069570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.168] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9069570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.168] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0041.168] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5616fca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bf7e690, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bf7e690, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Services", cAlternateFileName="")) returned 0 [0041.168] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0041.168] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x510b3550, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5616fca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5616fca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0 [0041.168] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.168] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x52437265, cFileName="Sun", cAlternateFileName="")) returned 1 [0041.168] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0041.169] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0041.169] CryptHashData (hHash=0x5c9000, pbData=0x33e06e0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.169] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9140) returned 1 [0041.169] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.169] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2234, pdwDataLen=0x18f410) returned 0 [0041.169] GetLastError () returned 0xea [0041.169] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2234*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2234*, pdwDataLen=0x18f40c*=0x260) returned 1 [0041.169] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0041.170] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0041.171] SetEndOfFile (hFile=0xec) returned 1 [0041.171] CloseHandle (hObject=0xec) returned 1 [0041.171] CryptDestroyKey (hKey=0x5c9140) returned 1 [0041.171] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.171] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0041.171] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.171] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9069570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.171] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Java", cAlternateFileName="")) returned 1 [0041.171] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.172] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.172] CryptHashData (hHash=0x5c9000, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.172] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0041.172] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.172] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e18d4*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e18d4, pdwDataLen=0x18f1a8) returned 0 [0041.172] GetLastError () returned 0xea [0041.172] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e18d4*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e18d4*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.172] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.174] WriteFile (in: hFile=0xe8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.175] SetEndOfFile (hFile=0xe8) returned 1 [0041.175] CloseHandle (hObject=0xe8) returned 1 [0041.175] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.175] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.175] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.175] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.175] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AU", cAlternateFileName="")) returned 1 [0041.176] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.176] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.176] CryptHashData (hHash=0x5c9000, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.176] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0041.176] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.176] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2258*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2258, pdwDataLen=0x18ef40) returned 0 [0041.176] GetLastError () returned 0xea [0041.176] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2258*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2258*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.177] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.178] WriteFile (in: hFile=0xf0, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.178] SetEndOfFile (hFile=0xf0) returned 1 [0041.179] CloseHandle (hObject=0xf0) returned 1 [0041.179] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.179] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.179] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.179] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.179] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8e062, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="au.cab", cAlternateFileName="")) returned 1 [0041.179] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7eec92c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d400, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="au.msi", cAlternateFileName="")) returned 1 [0041.179] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9069570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa908f6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.179] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9069570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa908f6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.179] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.179] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0041.179] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.180] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.180] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.180] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9000) returned 1 [0041.180] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.180] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2248, pdwDataLen=0x18ef40) returned 0 [0041.180] GetLastError () returned 0xea [0041.180] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2248*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.180] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.546] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.547] SetEndOfFile (hFile=0xf0) returned 1 [0041.547] CloseHandle (hObject=0xf0) returned 1 [0041.548] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.548] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.548] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa93fb670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa93fb670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.548] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa93fb670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa93fb670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.548] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1ea6db0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfec5c570, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="deployment.properties", cAlternateFileName="DEPLOY~1.PRO")) returned 1 [0041.548] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa908f6d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa908f6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa93fb670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.548] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="security", cAlternateFileName="")) returned 1 [0041.548] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.549] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.549] CryptHashData (hHash=0x5c8fc0, pbData=0x33e11ec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.549] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0041.549] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.549] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2248, pdwDataLen=0x18ecd8) returned 0 [0041.549] GetLastError () returned 0xea [0041.550] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2248*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.550] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\security\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.551] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.552] SetEndOfFile (hFile=0x108) returned 1 [0041.552] CloseHandle (hObject=0x108) returned 1 [0041.552] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.552] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.552] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa93fb670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa93fb670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.552] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa93fb670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa93fb670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.552] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa93fb670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa93fb670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94217d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.552] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa93fb670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa93fb670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94217d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.552] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.552] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="tmp", cAlternateFileName="")) returned 1 [0041.552] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.553] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.553] CryptHashData (hHash=0x5c9040, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.553] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8fc0) returned 1 [0041.553] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.553] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2248, pdwDataLen=0x18ecd8) returned 0 [0041.553] GetLastError () returned 0xea [0041.553] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2248*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.554] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.554] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.555] SetEndOfFile (hFile=0x108) returned 1 [0041.555] CloseHandle (hObject=0x108) returned 1 [0041.555] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.555] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.555] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa94217d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94217d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.555] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa94217d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94217d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.555] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94217d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94217d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94217d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.555] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="si", cAlternateFileName="")) returned 1 [0041.555] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.556] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.556] CryptHashData (hHash=0x5c9040, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.556] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0041.556] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.556] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2248, pdwDataLen=0x18ea70) returned 0 [0041.556] GetLastError () returned 0xea [0041.556] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2248*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.556] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\si\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.562] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.563] SetEndOfFile (hFile=0x114) returned 1 [0041.563] CloseHandle (hObject=0x114) returned 1 [0041.563] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.563] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.563] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa94217d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94217d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.563] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa94217d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94217d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.563] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94217d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94217d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94217d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.563] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94217d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94217d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94217d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.563] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.563] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfeca8830, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="si", cAlternateFileName="")) returned 0 [0041.564] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.564] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="tmp", cAlternateFileName="")) returned 0 [0041.564] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.564] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9069570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9069570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9069570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.564] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 1 [0041.564] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.564] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.564] CryptHashData (hHash=0x5c9000, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.564] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0041.564] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.564] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2248, pdwDataLen=0x18ef40) returned 0 [0041.564] GetLastError () returned 0xea [0041.564] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2248*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2248*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.565] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.577] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.578] SetEndOfFile (hFile=0xf0) returned 1 [0041.578] CloseHandle (hObject=0xf0) returned 1 [0041.578] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.578] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.578] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa9447930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9447930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.578] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa9447930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9447930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.578] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x182ac2a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Data1.cab", cAlternateFileName="")) returned 1 [0041.578] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94217d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94217d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9447930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.578] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 1 [0041.578] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68d26e60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd600, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="jre1.7.0_45.msi", cAlternateFileName="JRE170~1.MSI")) returned 0 [0041.578] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.579] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 0 [0041.579] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0041.579] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Java", cAlternateFileName="")) returned 0 [0041.579] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0041.579] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x52437265, cFileName="Sun", cAlternateFileName="")) returned 0 [0041.579] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0041.579] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa557f4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa557f4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Roaming", cAlternateFileName="")) returned 1 [0041.579] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0041.579] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0041.579] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.579] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9140) returned 1 [0041.579] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0041.579] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1524*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e1524, pdwDataLen=0x18f678) returned 0 [0041.580] GetLastError () returned 0xea [0041.580] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1524*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e1524*, pdwDataLen=0x18f674*=0x260) returned 1 [0041.580] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0041.580] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0041.581] SetEndOfFile (hFile=0xf8) returned 1 [0041.581] CloseHandle (hObject=0xf8) returned 1 [0041.581] CryptDestroyKey (hKey=0x5c9140) returned 1 [0041.581] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.582] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9447930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9447930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0041.582] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9447930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9447930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.582] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9dac9f0, ftCreationTime.dwHighDateTime=0x1d4d207, ftLastAccessTime.dwLowDateTime=0x23a43e0, ftLastAccessTime.dwHighDateTime=0x1d4c577, ftLastWriteTime.dwLowDateTime=0x23a43e0, ftLastWriteTime.dwHighDateTime=0x1d4c577, nFileSizeHigh=0x0, nFileSizeLow=0x7bf1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="-xR0ig.m4a", cAlternateFileName="")) returned 1 [0041.582] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa437ee90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa437ee90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa43a4ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbe71, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="00EdcFm8.png.crypt", cAlternateFileName="00EDCF~1.CRY")) returned 1 [0041.582] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa43a4ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa43a4ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa43a4ff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3630, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0AXJYT.png.crypt", cAlternateFileName="0AXJYT~1.CRY")) returned 1 [0041.582] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2980da0, ftCreationTime.dwHighDateTime=0x1d4c634, ftLastAccessTime.dwLowDateTime=0x382526c0, ftLastAccessTime.dwHighDateTime=0x1d4cd9f, ftLastWriteTime.dwLowDateTime=0x382526c0, ftLastWriteTime.dwHighDateTime=0x1d4cd9f, nFileSizeHigh=0x0, nFileSizeLow=0x2125, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1lg2N.swf", cAlternateFileName="")) returned 1 [0041.582] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa43a4ff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa43a4ff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa43cb150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x40ac, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="6XhrqzP.png.crypt", cAlternateFileName="6XHRQZ~1.CRY")) returned 1 [0041.582] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbbf4770, ftCreationTime.dwHighDateTime=0x1d4d101, ftLastAccessTime.dwLowDateTime=0x89124b30, ftLastAccessTime.dwHighDateTime=0x1d4ccc8, ftLastWriteTime.dwLowDateTime=0x89124b30, ftLastWriteTime.dwHighDateTime=0x1d4ccc8, nFileSizeHigh=0x0, nFileSizeLow=0x11e93, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="9IQcq xw6DsLpZv.swf", cAlternateFileName="9IQCQX~1.SWF")) returned 1 [0041.582] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Adobe", cAlternateFileName="")) returned 1 [0041.582] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0041.582] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0041.583] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.583] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0041.583] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0041.583] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f410) returned 0 [0041.583] GetLastError () returned 0xea [0041.583] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f40c*=0x260) returned 1 [0041.583] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0041.584] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0041.585] SetEndOfFile (hFile=0xec) returned 1 [0041.585] CloseHandle (hObject=0xec) returned 1 [0041.585] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.585] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.586] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9447930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9447930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.586] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9447930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9447930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.586] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0041.586] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.586] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.586] CryptHashData (hHash=0x5c91c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.586] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8fc0) returned 1 [0041.586] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0041.586] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18f1a8) returned 0 [0041.586] GetLastError () returned 0xea [0041.586] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.587] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.587] WriteFile (in: hFile=0xe8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.588] SetEndOfFile (hFile=0xe8) returned 1 [0041.588] CloseHandle (hObject=0xe8) returned 1 [0041.588] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.588] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.588] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa946da90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa946da90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.589] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa946da90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa946da90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.589] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="10.0", cAlternateFileName="")) returned 1 [0041.589] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.589] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.589] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.589] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9000) returned 1 [0041.589] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0041.589] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e218c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e218c, pdwDataLen=0x18ef40) returned 0 [0041.589] GetLastError () returned 0xea [0041.589] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e218c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e218c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.590] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.598] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.599] SetEndOfFile (hFile=0xf0) returned 1 [0041.599] CloseHandle (hObject=0xf0) returned 1 [0041.599] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.599] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.599] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa946da90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa946da90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.599] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa946da90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa946da90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.600] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Collab", cAlternateFileName="")) returned 1 [0041.600] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.600] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.600] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.600] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9100) returned 1 [0041.600] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0041.600] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e218c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e218c, pdwDataLen=0x18ecd8) returned 0 [0041.600] GetLastError () returned 0xea [0041.600] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e218c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e218c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.601] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\collab\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.601] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.602] SetEndOfFile (hFile=0x108) returned 1 [0041.602] CloseHandle (hObject=0x108) returned 1 [0041.602] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.602] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.602] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9493bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9493bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.602] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9493bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9493bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.602] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9493bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9493bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9493bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.603] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9493bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9493bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9493bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.603] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.603] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Forms", cAlternateFileName="")) returned 1 [0041.603] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.603] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.603] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.603] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c91c0) returned 1 [0041.603] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.603] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.603] GetLastError () returned 0xea [0041.603] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.604] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\forms\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.604] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.605] SetEndOfFile (hFile=0x108) returned 1 [0041.605] CloseHandle (hObject=0x108) returned 1 [0041.605] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0041.605] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.605] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9493bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9493bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0041.605] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9493bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9493bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.605] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9493bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9493bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9493bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.606] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9493bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9493bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9493bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.606] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0041.606] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa946da90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa946da90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9493bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.606] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1 [0041.606] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.606] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.606] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.606] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9100) returned 1 [0041.606] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0041.606] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.606] GetLastError () returned 0xea [0041.606] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.607] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.620] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.621] SetEndOfFile (hFile=0x108) returned 1 [0041.621] CloseHandle (hObject=0x108) returned 1 [0041.621] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.621] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.622] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa94b9d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94b9d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.622] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xa94b9d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94b9d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.622] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="glob.js", cAlternateFileName="")) returned 1 [0041.622] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 1 [0041.622] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9493bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9493bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94b9d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.622] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9493bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9493bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94b9d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.622] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.622] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Security", cAlternateFileName="")) returned 1 [0041.622] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.623] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.623] CryptHashData (hHash=0x5c9100, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.623] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c91c0) returned 1 [0041.623] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.623] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.623] GetLastError () returned 0xea [0041.623] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.623] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.623] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.624] SetEndOfFile (hFile=0x108) returned 1 [0041.624] CloseHandle (hObject=0x108) returned 1 [0041.625] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0041.625] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.625] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa94b9d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94b9d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0041.625] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa94b9d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94b9d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.625] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0041.625] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0041.625] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.625] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.626] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.626] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0041.626] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.626] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0041.626] GetLastError () returned 0xea [0041.626] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.626] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.630] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.631] SetEndOfFile (hFile=0x114) returned 1 [0041.631] CloseHandle (hObject=0x114) returned 1 [0041.631] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.631] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.631] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.632] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.632] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefc97c0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", cAlternateFileName="48B764~1.CRL")) returned 1 [0041.632] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 1 [0041.632] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94b9d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94b9d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.632] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94b9d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94b9d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.632] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.632] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94b9d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94b9d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94b9d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.632] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94b9d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94b9d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94b9d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.632] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0041.632] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Security", cAlternateFileName="")) returned 0 [0041.632] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.632] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa946da90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa946da90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa946da90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.632] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa946da90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa946da90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa946da90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.632] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.632] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0041.632] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.633] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.633] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.633] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9000) returned 1 [0041.633] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.633] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.633] GetLastError () returned 0xea [0041.633] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.633] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.634] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.635] SetEndOfFile (hFile=0xe8) returned 1 [0041.635] CloseHandle (hObject=0xe8) returned 1 [0041.635] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.635] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.635] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.635] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.635] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0041.635] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.636] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.636] CryptHashData (hHash=0x5c8fc0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.636] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c91c0) returned 1 [0041.636] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.636] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.636] GetLastError () returned 0xea [0041.636] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.636] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.637] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.637] SetEndOfFile (hFile=0xf0) returned 1 [0041.638] CloseHandle (hObject=0xf0) returned 1 [0041.638] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0041.638] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.638] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0041.638] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.638] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1 [0041.638] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.639] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.639] CryptHashData (hHash=0x5c8fc0, pbData=0x298a44, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.639] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0041.639] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.639] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.639] GetLastError () returned 0xea [0041.639] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.639] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\d5ntrc6r\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.640] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.640] SetEndOfFile (hFile=0x108) returned 1 [0041.641] CloseHandle (hObject=0x108) returned 1 [0041.641] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.641] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.641] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.641] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.641] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94dfeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.641] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94dfeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.641] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.641] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94dfeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.641] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94dfeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.641] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0041.641] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94dfeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.641] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94dfeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.641] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.641] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0041.641] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.642] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.642] CryptHashData (hHash=0x5c9000, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.642] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c91c0) returned 1 [0041.642] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.642] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.642] GetLastError () returned 0xea [0041.642] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.642] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\headlights\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.643] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.644] SetEndOfFile (hFile=0xe8) returned 1 [0041.644] CloseHandle (hObject=0xe8) returned 1 [0041.644] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0041.644] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.644] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0041.644] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.644] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94dfeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.644] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa94dfeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa94dfeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa94dfeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.644] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0041.644] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9447930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9447930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa946da90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.644] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0041.645] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.646] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.646] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.646] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9000) returned 1 [0041.646] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0041.646] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.647] GetLastError () returned 0xea [0041.647] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.647] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.647] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.648] SetEndOfFile (hFile=0xe8) returned 1 [0041.648] CloseHandle (hObject=0xe8) returned 1 [0041.648] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.648] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.648] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.649] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.649] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0041.649] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.649] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.649] CryptHashData (hHash=0x5c91c0, pbData=0x1fc6440, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.649] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0041.649] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0041.649] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.649] GetLastError () returned 0xea [0041.649] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.650] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\dictionaries\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.650] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.651] SetEndOfFile (hFile=0xf0) returned 1 [0041.651] CloseHandle (hObject=0xf0) returned 1 [0041.651] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.651] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.651] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.652] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.652] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9506010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.652] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9506010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.652] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.652] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9506010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.652] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9506010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.652] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.652] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0041.652] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.652] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.652] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.652] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0041.653] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.653] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.653] GetLastError () returned 0xea [0041.653] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.653] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\logtransport2\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.653] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.654] SetEndOfFile (hFile=0xe8) returned 1 [0041.654] CloseHandle (hObject=0xe8) returned 1 [0041.654] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.654] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.654] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.655] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.655] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9506010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.655] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9506010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.655] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.655] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0 [0041.655] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0041.655] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa43f12b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa43f12b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa43f12b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xfec7, dwReserved0=0x20453274, dwReserved1=0x52434e45, cFileName="bhUHT.jpg.crypt", cAlternateFileName="BHUHTJ~1.CRY")) returned 1 [0041.655] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa43f12b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa43f12b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4417410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9a2a, dwReserved0=0x20453274, dwReserved1=0x52434e45, cFileName="D0zcRpw_caOcZNoV4mkG.png.crypt", cAlternateFileName="D0ZCRP~1.CRY")) returned 1 [0041.655] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf87a0940, ftCreationTime.dwHighDateTime=0x1d4cd1d, ftLastAccessTime.dwLowDateTime=0x1e17b6c0, ftLastAccessTime.dwHighDateTime=0x1d4cf9e, ftLastWriteTime.dwLowDateTime=0x1e17b6c0, ftLastWriteTime.dwHighDateTime=0x1d4cf9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb6b, dwReserved0=0x20453274, dwReserved1=0x52434e45, cFileName="eMhUXRXBgUglxcn3.bmp", cAlternateFileName="EMHUXR~1.BMP")) returned 1 [0041.655] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe6eaf70, ftCreationTime.dwHighDateTime=0x1d4d06b, ftLastAccessTime.dwLowDateTime=0x9a4d6180, ftLastAccessTime.dwHighDateTime=0x1d4cc66, ftLastWriteTime.dwLowDateTime=0x9a4d6180, ftLastWriteTime.dwHighDateTime=0x1d4cc66, nFileSizeHigh=0x0, nFileSizeLow=0x6138, dwReserved0=0x20453274, dwReserved1=0x52434e45, cFileName="FEq4-A1qhZz_4.bmp", cAlternateFileName="FEQ4-A~1.BMP")) returned 1 [0041.655] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9447930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9447930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9447930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20453274, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.655] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20453274, dwReserved1=0x52434e45, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0041.655] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0041.656] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0041.656] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.656] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9040) returned 1 [0041.656] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0041.656] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f410) returned 0 [0041.656] GetLastError () returned 0xea [0041.656] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f40c*=0x260) returned 1 [0041.656] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0041.657] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0041.658] SetEndOfFile (hFile=0xec) returned 1 [0041.658] CloseHandle (hObject=0xec) returned 1 [0041.658] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.658] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.658] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.658] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.658] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9506010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.658] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0041.658] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.659] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.659] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.659] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9000) returned 1 [0041.659] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0041.659] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.659] GetLastError () returned 0xea [0041.659] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.659] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.660] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.661] SetEndOfFile (hFile=0xe8) returned 1 [0041.661] CloseHandle (hObject=0xe8) returned 1 [0041.661] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.661] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.661] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.662] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9506010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.662] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9506010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.662] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9506010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9506010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.662] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.662] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0041.662] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.662] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3b473ea0, ftCreationTime.dwHighDateTime=0x1d4cf5d, ftLastAccessTime.dwLowDateTime=0x4153c710, ftLastAccessTime.dwHighDateTime=0x1d4cc4b, ftLastWriteTime.dwLowDateTime=0x4153c710, ftLastWriteTime.dwHighDateTime=0x1d4cc4b, nFileSizeHigh=0x0, nFileSizeLow=0x5501, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="J3ZkluwvkiGXI8r-B5.odp", cAlternateFileName="J3ZKLU~1.ODP")) returned 1 [0041.662] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a2cbb90, ftCreationTime.dwHighDateTime=0x1d4cd68, ftLastAccessTime.dwLowDateTime=0xe37d17f0, ftLastAccessTime.dwHighDateTime=0x1d4cf4b, ftLastWriteTime.dwLowDateTime=0xe37d17f0, ftLastWriteTime.dwHighDateTime=0x1d4cf4b, nFileSizeHigh=0x0, nFileSizeLow=0x4833, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="KogUT5xtVfTznY5.wav", cAlternateFileName="KOGUT5~1.WAV")) returned 1 [0041.662] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcba4810, ftCreationTime.dwHighDateTime=0x1d4c7c0, ftLastAccessTime.dwLowDateTime=0xaf62d4a0, ftLastAccessTime.dwHighDateTime=0x1d4d2cf, ftLastWriteTime.dwLowDateTime=0xaf62d4a0, ftLastWriteTime.dwHighDateTime=0x1d4d2cf, nFileSizeHigh=0x0, nFileSizeLow=0x15c4b, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="lAQFBeUeHy.gif", cAlternateFileName="LAQFBE~1.GIF")) returned 1 [0041.662] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0041.662] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0041.662] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0041.663] CryptHashData (hHash=0x5c9040, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.663] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9000) returned 1 [0041.663] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.663] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f410) returned 0 [0041.663] GetLastError () returned 0xea [0041.663] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f40c*=0x260) returned 1 [0041.663] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0041.664] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0041.664] SetEndOfFile (hFile=0xec) returned 1 [0041.665] CloseHandle (hObject=0xec) returned 1 [0041.665] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.665] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.665] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.665] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.665] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0041.665] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.666] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.666] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.666] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0041.666] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.666] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.666] GetLastError () returned 0xea [0041.666] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.666] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.669] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.670] SetEndOfFile (hFile=0xe8) returned 1 [0041.671] CloseHandle (hObject=0xe8) returned 1 [0041.671] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.671] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.671] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.671] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.671] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0041.671] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.672] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.672] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.672] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c91c0) returned 1 [0041.672] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.672] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.672] GetLastError () returned 0xea [0041.672] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.672] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.673] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.673] SetEndOfFile (hFile=0xf0) returned 1 [0041.674] CloseHandle (hObject=0xf0) returned 1 [0041.674] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0041.674] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.674] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0041.674] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.674] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa952c170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.674] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0041.674] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.675] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.675] CryptHashData (hHash=0x5c9040, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.675] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8fc0) returned 1 [0041.675] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.675] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.675] GetLastError () returned 0xea [0041.675] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.675] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\p7y3f7qb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.676] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.677] SetEndOfFile (hFile=0x108) returned 1 [0041.677] CloseHandle (hObject=0x108) returned 1 [0041.677] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.677] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.677] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.677] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.677] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa952c170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95522d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.677] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa952c170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95522d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.677] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.677] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0 [0041.677] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0041.677] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa952c170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.677] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0041.677] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.678] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.678] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.678] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0041.678] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0041.678] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.678] GetLastError () returned 0xea [0041.678] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.679] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.679] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.680] SetEndOfFile (hFile=0xf0) returned 1 [0041.680] CloseHandle (hObject=0xf0) returned 1 [0041.680] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.680] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.680] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa95522d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95522d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.680] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa95522d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95522d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.680] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95522d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95522d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95522d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.680] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="support", cAlternateFileName="")) returned 1 [0041.681] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.681] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.681] CryptHashData (hHash=0x5c91c0, pbData=0x33e06e0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.681] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0041.681] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0041.681] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.681] GetLastError () returned 0xea [0041.681] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.682] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.682] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.683] SetEndOfFile (hFile=0x108) returned 1 [0041.683] CloseHandle (hObject=0x108) returned 1 [0041.683] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.683] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.683] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa95522d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95522d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.683] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa95522d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95522d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.683] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0041.683] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.684] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.684] CryptHashData (hHash=0x5c91c0, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.684] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0041.684] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0041.684] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0041.684] GetLastError () returned 0xea [0041.684] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.684] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.685] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.686] SetEndOfFile (hFile=0x114) returned 1 [0041.686] CloseHandle (hObject=0x114) returned 1 [0041.686] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.686] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.686] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa95522d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95522d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.686] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa95522d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95522d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.686] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95522d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95522d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95522d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.686] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="sys", cAlternateFileName="")) returned 1 [0041.686] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0041.687] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0041.687] CryptHashData (hHash=0x5c91c0, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.687] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c8ec0) returned 1 [0041.687] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0041.687] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18e808) returned 0 [0041.687] GetLastError () returned 0xea [0041.687] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18e804*=0x260) returned 1 [0041.687] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0041.700] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0041.701] SetEndOfFile (hFile=0x104) returned 1 [0041.701] CloseHandle (hObject=0x104) returned 1 [0041.701] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0041.701] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.701] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa9578430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9578430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0041.702] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0xa9578430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9578430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.702] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9578430, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9578430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9578430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.702] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="settings.sol", cAlternateFileName="")) returned 1 [0041.702] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="settings.sol", cAlternateFileName="")) returned 0 [0041.702] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0041.702] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="sys", cAlternateFileName="")) returned 0 [0041.702] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.702] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95522d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95522d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95522d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.702] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95522d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95522d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95522d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.702] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.702] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="support", cAlternateFileName="")) returned 0 [0041.702] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.702] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0041.702] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0041.702] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa952c170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x206d6f63, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.702] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa952c170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa952c170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa952c170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x206d6f63, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.702] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.702] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0041.702] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0041.703] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0041.703] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.703] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0041.703] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.703] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f410) returned 0 [0041.703] GetLastError () returned 0xea [0041.703] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f40c*=0x260) returned 1 [0041.703] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0041.706] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0041.707] SetEndOfFile (hFile=0xec) returned 1 [0041.707] CloseHandle (hObject=0xec) returned 1 [0041.708] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0041.708] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.708] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9578430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9578430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0041.708] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9578430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9578430, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.708] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x7c36290, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x7c36290, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AddIns", cAlternateFileName="")) returned 1 [0041.708] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.708] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.708] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.708] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8fc0) returned 1 [0041.708] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.708] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.709] GetLastError () returned 0xea [0041.709] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.709] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\addins\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.710] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.710] SetEndOfFile (hFile=0xe8) returned 1 [0041.711] CloseHandle (hObject=0xe8) returned 1 [0041.711] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.711] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.711] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.711] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7c36290, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.711] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa959e590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.711] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa959e590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.711] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.711] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0041.711] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.712] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.712] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.712] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9000) returned 1 [0041.712] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.712] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.712] GetLastError () returned 0xea [0041.712] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.712] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\credentials\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.713] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.714] SetEndOfFile (hFile=0xe8) returned 1 [0041.714] CloseHandle (hObject=0xe8) returned 1 [0041.714] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.714] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.714] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.714] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.714] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa959e590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.714] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa959e590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.714] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.714] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Crypto", cAlternateFileName="")) returned 1 [0041.715] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.715] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.715] CryptHashData (hHash=0x5c9000, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.715] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8fc0) returned 1 [0041.715] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.715] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.715] GetLastError () returned 0xea [0041.715] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.716] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.716] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.717] SetEndOfFile (hFile=0xe8) returned 1 [0041.717] CloseHandle (hObject=0xe8) returned 1 [0041.717] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.717] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.717] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.717] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.717] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa959e590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.717] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RSA", cAlternateFileName="")) returned 1 [0041.717] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.718] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.718] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.718] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0041.718] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.718] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.718] GetLastError () returned 0xea [0041.718] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.718] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.719] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.720] SetEndOfFile (hFile=0xf0) returned 1 [0041.720] CloseHandle (hObject=0xf0) returned 1 [0041.720] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.720] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.720] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.720] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.720] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa959e590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.720] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0041.720] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.721] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.721] CryptHashData (hHash=0x5c9000, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.721] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9100) returned 1 [0041.721] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.721] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.721] GetLastError () returned 0xea [0041.721] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.721] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.722] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.723] SetEndOfFile (hFile=0x108) returned 1 [0041.723] CloseHandle (hObject=0x108) returned 1 [0041.723] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.723] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.724] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.724] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.724] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xa1e34990, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="83AA4C~1")) returned 1 [0041.724] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="932A2D~1")) returned 1 [0041.724] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xb0aa1fc0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0aa1fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0aa1fc0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="FDA992~1")) returned 1 [0041.724] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa959e590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.724] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa959e590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa959e590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.724] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.724] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x681f1360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa1e34990, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e34990, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0041.724] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.724] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x681f1360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x681f1360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RSA", cAlternateFileName="")) returned 0 [0041.724] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.724] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0041.724] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.725] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.725] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.725] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0041.725] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.725] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.725] GetLastError () returned 0xea [0041.725] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.725] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.726] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.727] SetEndOfFile (hFile=0xe8) returned 1 [0041.727] CloseHandle (hObject=0xe8) returned 1 [0041.727] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.727] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.727] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.727] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.727] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1033", cAlternateFileName="")) returned 1 [0041.727] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.728] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.728] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.728] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0041.728] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.728] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.728] GetLastError () returned 0xea [0041.728] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.728] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.729] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.730] SetEndOfFile (hFile=0xf0) returned 1 [0041.730] CloseHandle (hObject=0xf0) returned 1 [0041.730] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.730] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.730] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.730] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.730] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f766d30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="14", cAlternateFileName="")) returned 1 [0041.730] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.731] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.731] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.731] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9000) returned 1 [0041.731] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.731] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.731] GetLastError () returned 0xea [0041.731] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.731] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.732] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.733] SetEndOfFile (hFile=0x108) returned 1 [0041.733] CloseHandle (hObject=0x108) returned 1 [0041.733] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.733] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.733] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.733] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.733] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f766d30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f766d30, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4e2b7e00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0041.733] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95c46f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.733] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95c46f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.733] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.733] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95c46f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.733] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95c46f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.733] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.734] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95c46f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.734] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95c46f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.734] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.734] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Excel", cAlternateFileName="")) returned 1 [0041.734] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.734] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.734] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.734] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0041.734] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.734] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.734] GetLastError () returned 0xea [0041.734] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.735] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.735] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.736] SetEndOfFile (hFile=0xe8) returned 1 [0041.736] CloseHandle (hObject=0xe8) returned 1 [0041.736] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.736] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.736] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.737] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1c1e0470, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.737] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95c46f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.737] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0041.737] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.738] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.738] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.738] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9000) returned 1 [0041.738] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.738] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.738] GetLastError () returned 0xea [0041.738] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.738] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\xlstart\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.742] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.743] SetEndOfFile (hFile=0xf0) returned 1 [0041.743] CloseHandle (hObject=0xf0) returned 1 [0041.743] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.743] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.743] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.743] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95c46f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.743] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95c46f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.743] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95c46f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95c46f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.743] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.743] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd01394e0, ftCreationTime.dwHighDateTime=0x1d301bc, ftLastAccessTime.dwLowDateTime=0xd01394e0, ftLastAccessTime.dwHighDateTime=0x1d301bc, ftLastWriteTime.dwLowDateTime=0xd01394e0, ftLastWriteTime.dwHighDateTime=0x1d301bc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0041.743] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.743] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9578430, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9578430, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa959e590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.743] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IME12", cAlternateFileName="")) returned 1 [0041.743] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.744] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.744] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.744] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9000) returned 1 [0041.744] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.744] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.744] GetLastError () returned 0xea [0041.744] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.744] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ime12\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.745] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.746] SetEndOfFile (hFile=0xe8) returned 1 [0041.746] CloseHandle (hObject=0xe8) returned 1 [0041.746] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.746] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.746] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa95ea850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.746] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa95ea850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.747] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95ea850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95ea850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.747] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95ea850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95ea850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.747] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.747] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IMJP12", cAlternateFileName="")) returned 1 [0041.747] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.747] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.747] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.747] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0041.747] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.747] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.747] GetLastError () returned 0xea [0041.747] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.748] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp12\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.748] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.749] SetEndOfFile (hFile=0xe8) returned 1 [0041.749] CloseHandle (hObject=0xe8) returned 1 [0041.749] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.749] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.750] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa95ea850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.750] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa95ea850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.750] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95ea850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95ea850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.750] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95ea850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95ea850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.750] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.750] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IMJP8_1", cAlternateFileName="")) returned 1 [0041.750] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.751] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.751] CryptHashData (hHash=0x5c9100, pbData=0x33e070c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.751] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9000) returned 1 [0041.751] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.751] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.751] GetLastError () returned 0xea [0041.751] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.751] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp8_1\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.752] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.753] SetEndOfFile (hFile=0xe8) returned 1 [0041.753] CloseHandle (hObject=0xe8) returned 1 [0041.753] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.753] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.753] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa95ea850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.753] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa95ea850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.753] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95ea850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95ea850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.753] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa95ea850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa95ea850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa95ea850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.753] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.753] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IMJP9_0", cAlternateFileName="")) returned 1 [0041.753] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.754] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.754] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.754] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0041.754] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.754] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.754] GetLastError () returned 0xea [0041.754] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.754] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp9_0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.755] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.756] SetEndOfFile (hFile=0xe8) returned 1 [0041.756] CloseHandle (hObject=0xe8) returned 1 [0041.756] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.756] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.756] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa96109b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96109b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.757] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa96109b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96109b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.757] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96109b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96109b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96109b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.757] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96109b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96109b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96109b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.757] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.757] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0041.757] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.757] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.757] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.757] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9000) returned 1 [0041.757] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.757] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.757] GetLastError () returned 0xea [0041.758] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.758] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.764] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.765] SetEndOfFile (hFile=0xe8) returned 1 [0041.765] CloseHandle (hObject=0xe8) returned 1 [0041.765] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.765] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.765] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa96109b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96109b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.765] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa96109b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96109b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.765] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96109b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96109b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96109b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.765] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa4678a10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4678a10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0041.766] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.766] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.766] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.766] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0041.766] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.766] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.766] GetLastError () returned 0xea [0041.766] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.767] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.767] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.768] SetEndOfFile (hFile=0xf0) returned 1 [0041.768] CloseHandle (hObject=0xf0) returned 1 [0041.768] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.768] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.768] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa96109b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96109b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.768] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa96109b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96109b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.769] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45941d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa45941d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa45941d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0041.769] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45941d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa45941d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa45941d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8e9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Google Chrome.lnk.crypt", cAlternateFileName="GOOGLE~1.CRY")) returned 1 [0041.769] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96109b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96109b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96109b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.769] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45ba330, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa45ba330, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa45ba330, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Launch Internet Explorer Browser.lnk.crypt", cAlternateFileName="LAUNCH~1.CRY")) returned 1 [0041.769] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45ba330, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa45ba330, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa45ba330, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Shows Desktop.lnk.crypt", cAlternateFileName="SHOWSD~1.CRY")) returned 1 [0041.769] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1 [0041.769] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.769] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.769] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.769] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8fc0) returned 1 [0041.769] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.769] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.769] GetLastError () returned 0xea [0041.769] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.781] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.791] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.792] SetEndOfFile (hFile=0x108) returned 1 [0041.793] CloseHandle (hObject=0x108) returned 1 [0041.793] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.793] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.793] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa965cc70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa965cc70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.793] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa965cc70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa965cc70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.793] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9636b10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9636b10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa965cc70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.793] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0041.793] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.794] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.794] CryptHashData (hHash=0x5c9100, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.794] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c8ec0) returned 1 [0041.794] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.794] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0041.794] GetLastError () returned 0xea [0041.794] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.794] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.796] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.797] SetEndOfFile (hFile=0x114) returned 1 [0041.797] CloseHandle (hObject=0x114) returned 1 [0041.797] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0041.797] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.797] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa965cc70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa965cc70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0041.798] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa965cc70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa965cc70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.798] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa965cc70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa965cc70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa965cc70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.798] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa965cc70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa965cc70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa965cc70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.798] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0041.798] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa4678a10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4678a10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0041.798] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.799] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.799] CryptHashData (hHash=0x5c8ec0, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.799] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0041.799] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0041.799] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0041.799] GetLastError () returned 0xea [0041.799] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.799] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.802] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.803] SetEndOfFile (hFile=0x114) returned 1 [0041.803] CloseHandle (hObject=0x114) returned 1 [0041.803] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.804] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.804] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa965cc70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa965cc70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.804] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa965cc70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa965cc70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa45ba330, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa45ba330, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa46065f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa46065f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa46065f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa46065f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Google Chrome.lnk.crypt", cAlternateFileName="GOOGLE~1.CRY")) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa965cc70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa965cc70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9682dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa46065f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa46065f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa46065f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Internet Explorer (2).lnk.crypt", cAlternateFileName="INTERN~1.CRY")) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa462c750, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa462c750, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa462c750, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Internet Explorer.lnk.crypt", cAlternateFileName="INTERN~2.CRY")) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa462c750, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa462c750, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa462c750, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Mozilla Firefox.lnk.crypt", cAlternateFileName="MOZILL~1.CRY")) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa46528b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa46528b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa46528b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Explorer (2).lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa46528b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa46528b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa46528b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Explorer.lnk.crypt", cAlternateFileName="WINDOW~2.CRY")) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa46528b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa46528b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa46528b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Media Player (2).lnk.crypt", cAlternateFileName="WINDOW~3.CRY")) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4678a10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4678a10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4678a10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Media Player.lnk.crypt", cAlternateFileName="WINDOW~4.CRY")) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4678a10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4678a10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4678a10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Media Player.lnk.crypt", cAlternateFileName="WINDOW~4.CRY")) returned 0 [0041.804] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa4678a10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4678a10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0041.804] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4678a10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4678a10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4678a10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4678a10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4678a10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4678a10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 0 [0041.804] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.804] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="UserData", cAlternateFileName="")) returned 1 [0041.804] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.805] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.805] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.805] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0041.805] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.805] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.805] GetLastError () returned 0xea [0041.805] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.805] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.806] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.807] SetEndOfFile (hFile=0xf0) returned 1 [0041.807] CloseHandle (hObject=0xf0) returned 1 [0041.807] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.807] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.807] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9682dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9682dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.808] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9682dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9682dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.808] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9682dd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9682dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9682dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.808] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 1 [0041.808] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.808] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.808] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.808] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9100) returned 1 [0041.809] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.809] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.809] GetLastError () returned 0xea [0041.809] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.809] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.811] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.812] SetEndOfFile (hFile=0x108) returned 1 [0041.812] CloseHandle (hObject=0x108) returned 1 [0041.812] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.812] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.812] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9682dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9682dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.812] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9682dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9682dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.812] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="65UX3YG0", cAlternateFileName="")) returned 1 [0041.812] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.813] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.813] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.813] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c8ec0) returned 1 [0041.813] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.813] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0041.813] GetLastError () returned 0xea [0041.813] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.813] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\65ux3yg0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.814] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.815] SetEndOfFile (hFile=0x114) returned 1 [0041.815] CloseHandle (hObject=0x114) returned 1 [0041.815] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0041.815] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.815] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9682dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9682dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0041.815] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa9682dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9682dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.815] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9682dd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9682dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9682dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.815] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9682dd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9682dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9682dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.815] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0041.815] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="AY721QDR", cAlternateFileName="")) returned 1 [0041.815] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.816] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.816] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.816] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0041.816] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0041.816] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0041.816] GetLastError () returned 0xea [0041.816] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.816] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\ay721qdr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.817] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.818] SetEndOfFile (hFile=0x114) returned 1 [0041.818] CloseHandle (hObject=0x114) returned 1 [0041.818] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.818] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.818] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.818] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.818] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96a8f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.818] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96a8f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.818] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.818] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="DZBKZBIC", cAlternateFileName="")) returned 1 [0041.818] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.819] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.819] CryptHashData (hHash=0x5c9040, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.819] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c8ec0) returned 1 [0041.819] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.819] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0041.819] GetLastError () returned 0xea [0041.819] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.820] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\dzbkzbic\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.820] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.821] SetEndOfFile (hFile=0x114) returned 1 [0041.821] CloseHandle (hObject=0x114) returned 1 [0041.821] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0041.821] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.821] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0041.821] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.821] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96a8f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.821] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96a8f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.821] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0041.821] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9682dd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9682dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9682dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.822] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="index.dat", cAlternateFileName="")) returned 1 [0041.822] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 1 [0041.822] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.822] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.822] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.822] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0041.822] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0041.822] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0041.822] GetLastError () returned 0xea [0041.822] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.823] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\vrlzoz0e\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.823] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.824] SetEndOfFile (hFile=0x114) returned 1 [0041.824] CloseHandle (hObject=0x114) returned 1 [0041.824] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.824] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.824] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.824] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.825] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96a8f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.825] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96a8f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.825] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.825] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b9d5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="VRLZOZ0E", cAlternateFileName="")) returned 0 [0041.825] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.825] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b9d5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b9d5d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 0 [0041.825] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.825] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54b77470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54b77470, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x54b77470, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="UserData", cAlternateFileName="")) returned 0 [0041.825] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.825] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x2f5d6350, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x2f5d6350, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20455268, dwReserved1=0x52434e45, cFileName="MMC", cAlternateFileName="")) returned 1 [0041.825] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.826] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.826] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.826] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8fc0) returned 1 [0041.826] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.826] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.826] GetLastError () returned 0xea [0041.826] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.826] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\mmc\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.827] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.828] SetEndOfFile (hFile=0xe8) returned 1 [0041.828] CloseHandle (hObject=0xe8) returned 1 [0041.828] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.828] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.828] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.828] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f5d6350, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.828] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96a8f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.828] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96a8f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.828] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.828] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MS Project", cAlternateFileName="MSPROJ~1")) returned 1 [0041.828] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.829] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.829] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.829] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9000) returned 1 [0041.829] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.829] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.829] GetLastError () returned 0xea [0041.829] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.829] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.830] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.831] SetEndOfFile (hFile=0xe8) returned 1 [0041.831] CloseHandle (hObject=0xe8) returned 1 [0041.831] CryptDestroyKey (hKey=0x5c9000) returned 1 [0041.831] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.831] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0041.832] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.832] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="14", cAlternateFileName="")) returned 1 [0041.832] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.832] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.832] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.833] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0041.833] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.833] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.833] GetLastError () returned 0xea [0041.833] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.833] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.834] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.835] SetEndOfFile (hFile=0xf0) returned 1 [0041.835] CloseHandle (hObject=0xf0) returned 1 [0041.835] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.835] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.835] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.835] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.836] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8e064c0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1033", cAlternateFileName="")) returned 1 [0041.836] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.836] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.836] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.836] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0041.836] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.836] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.836] GetLastError () returned 0xea [0041.836] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.837] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.838] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.839] SetEndOfFile (hFile=0x108) returned 1 [0041.839] CloseHandle (hObject=0x108) returned 1 [0041.839] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.839] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.839] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.839] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8d940a0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.839] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e064c0, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x8e064c0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0xfee79d60, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x5f600, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Global.MPT", cAlternateFileName="")) returned 1 [0041.839] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96cf090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.839] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96cf090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.839] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.839] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96cf090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.839] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96cf090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.839] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.839] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96a8f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.839] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96a8f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96a8f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96a8f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.839] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0041.840] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Network", cAlternateFileName="")) returned 1 [0041.840] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.840] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.840] CryptHashData (hHash=0x5c9000, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.840] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0041.840] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.840] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.840] GetLastError () returned 0xea [0041.840] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.841] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.841] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.842] SetEndOfFile (hFile=0xe8) returned 1 [0041.842] CloseHandle (hObject=0xe8) returned 1 [0041.842] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.842] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.842] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.843] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.843] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0041.843] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.843] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.843] CryptHashData (hHash=0x5c9000, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.843] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0041.843] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.844] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.844] GetLastError () returned 0xea [0041.844] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.844] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.844] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.845] SetEndOfFile (hFile=0xf0) returned 1 [0041.845] CloseHandle (hObject=0xf0) returned 1 [0041.845] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.845] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.845] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.846] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.846] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96cf090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.846] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Pbk", cAlternateFileName="")) returned 1 [0041.846] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.846] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.846] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.846] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8fc0) returned 1 [0041.846] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.846] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.846] GetLastError () returned 0xea [0041.846] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.847] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.847] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.849] SetEndOfFile (hFile=0x108) returned 1 [0041.849] CloseHandle (hObject=0x108) returned 1 [0041.849] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.849] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.849] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.849] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.849] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96cf090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96f51f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.849] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 1 [0041.849] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0041.850] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0041.850] CryptHashData (hHash=0x5c9000, pbData=0x33e114c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.850] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c8ec0) returned 1 [0041.850] CryptDestroyHash (hHash=0x5c9000) returned 1 [0041.850] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0041.850] GetLastError () returned 0xea [0041.850] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0041.850] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0041.851] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.852] SetEndOfFile (hFile=0x114) returned 1 [0041.852] CloseHandle (hObject=0x114) returned 1 [0041.852] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0041.852] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.852] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa96f51f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96f51f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0041.852] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa96f51f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96f51f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.852] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96f51f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96f51f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96f51f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.852] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="rasphone.pbk", cAlternateFileName="")) returned 1 [0041.852] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0 [0041.852] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0041.852] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 0 [0041.852] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.852] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31a325d0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x31a325d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x31a325d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Pbk", cAlternateFileName="")) returned 0 [0041.852] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.853] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96cf090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.853] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96cf090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96cf090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96cf090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.853] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.853] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dae0390, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dae0390, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Office", cAlternateFileName="")) returned 1 [0041.853] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.853] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.853] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.853] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0041.853] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.853] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.853] GetLastError () returned 0xea [0041.853] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.854] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.854] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.855] SetEndOfFile (hFile=0xe8) returned 1 [0041.855] CloseHandle (hObject=0xe8) returned 1 [0041.855] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.856] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.856] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa96f51f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96f51f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.856] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43c8ae30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa96f51f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96f51f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.856] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96f51f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96f51f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96f51f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.856] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6ce7b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4f6ce7b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4f6ce7b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSO1033.acl", cAlternateFileName="")) returned 1 [0041.856] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Recent", cAlternateFileName="")) returned 1 [0041.856] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.857] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.857] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.857] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0041.857] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.857] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.857] GetLastError () returned 0xea [0041.857] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.857] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.861] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.862] SetEndOfFile (hFile=0xf0) returned 1 [0041.862] CloseHandle (hObject=0xf0) returned 1 [0041.862] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.862] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.862] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa96f51f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96f51f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.862] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa96f51f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96f51f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.862] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90b3d80, ftCreationTime.dwHighDateTime=0x1d305fe, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Global.LNK", cAlternateFileName="")) returned 1 [0041.862] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa96f51f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa96f51f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa96f51f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.862] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x90d9ee0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x34, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0041.862] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 1 [0041.862] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5dc5d150, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5dc5d150, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5dc5d150, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 0 [0041.862] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.862] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5dae0390, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x90b3d80, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x90b3d80, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Recent", cAlternateFileName="")) returned 0 [0041.862] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.862] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Outlook", cAlternateFileName="")) returned 1 [0041.862] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.863] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.863] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.863] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8fc0) returned 1 [0041.863] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.863] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.863] GetLastError () returned 0xea [0041.863] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.864] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.865] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.865] SetEndOfFile (hFile=0xe8) returned 1 [0041.866] CloseHandle (hObject=0xe8) returned 1 [0041.866] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.866] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.866] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.866] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5c734300, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.866] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa971b350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.866] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5de69980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5de69980, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5e0c9040, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Outlook.srs", cAlternateFileName="")) returned 1 [0041.866] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Outlook.xml", cAlternateFileName="")) returned 1 [0041.866] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6215c440, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Outlook.xml", cAlternateFileName="")) returned 0 [0041.866] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.866] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x33c0ebb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x33c0ebb0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="PowerPoint", cAlternateFileName="POWERP~1")) returned 1 [0041.866] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.867] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.867] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.867] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0041.867] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.867] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.867] GetLastError () returned 0xea [0041.867] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.867] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\powerpoint\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.868] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.869] SetEndOfFile (hFile=0xe8) returned 1 [0041.869] CloseHandle (hObject=0xe8) returned 1 [0041.869] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.869] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.869] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.870] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x33c0ebb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.870] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa971b350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.870] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa971b350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.870] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.870] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x510b16f0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x510b16f0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Proof", cAlternateFileName="")) returned 1 [0041.870] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.870] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.870] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.870] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8fc0) returned 1 [0041.870] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.870] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.871] GetLastError () returned 0xea [0041.871] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.871] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\proof\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.872] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.872] SetEndOfFile (hFile=0xe8) returned 1 [0041.873] CloseHandle (hObject=0xe8) returned 1 [0041.873] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.873] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.873] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.873] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x510b16f0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.873] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa971b350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.873] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa971b350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.873] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.873] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x541f1c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x541f1c70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Protect", cAlternateFileName="")) returned 1 [0041.873] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.874] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.874] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.874] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0041.874] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.874] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.874] GetLastError () returned 0xea [0041.874] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.874] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.875] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.876] SetEndOfFile (hFile=0xe8) returned 1 [0041.876] CloseHandle (hObject=0xe8) returned 1 [0041.876] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.876] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.876] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.876] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.876] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x138, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0041.876] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa971b350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.876] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1 [0041.876] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.877] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.877] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.877] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0041.877] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.877] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.877] GetLastError () returned 0xea [0041.877] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.877] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.879] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.880] SetEndOfFile (hFile=0xf0) returned 1 [0041.880] CloseHandle (hObject=0xf0) returned 1 [0041.880] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.880] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.880] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.880] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa971b350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.880] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1 [0041.880] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa971b350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa971b350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.880] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0041.880] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0041.880] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.880] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~2")) returned 1 [0041.880] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.881] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.881] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.881] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0041.881] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.881] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.881] GetLastError () returned 0xea [0041.881] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.881] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.882] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.883] SetEndOfFile (hFile=0xf0) returned 1 [0041.883] CloseHandle (hObject=0xf0) returned 1 [0041.884] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.884] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.884] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.884] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x541f1c70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.884] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf923e050, ftCreationTime.dwHighDateTime=0x1d3aab9, ftLastAccessTime.dwLowDateTime=0xf923e050, ftLastAccessTime.dwHighDateTime=0x1d3aab9, ftLastWriteTime.dwLowDateTime=0xf923e050, ftLastWriteTime.dwHighDateTime=0x1d3aab9, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="02540a10-7eb7-4b20-a8c7-470f8986389c", cAlternateFileName="02540A~1")) returned 1 [0041.884] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xdc5ea830, ftCreationTime.dwHighDateTime=0x1d41fce, ftLastAccessTime.dwLowDateTime=0xdc5ea830, ftLastAccessTime.dwHighDateTime=0x1d41fce, ftLastWriteTime.dwLowDateTime=0xdc5ea830, ftLastWriteTime.dwHighDateTime=0x1d41fce, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0e15476d-d8fe-46ca-8099-ebdcf80f637c", cAlternateFileName="0E1547~1")) returned 1 [0041.884] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6409280, ftCreationTime.dwHighDateTime=0x1d4ae2c, ftLastAccessTime.dwLowDateTime=0xf6409280, ftLastAccessTime.dwHighDateTime=0x1d4ae2c, ftLastWriteTime.dwLowDateTime=0xf6409280, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="102a7bc8-3f85-4bb4-840a-38257d2965d2", cAlternateFileName="102A7B~1")) returned 1 [0041.884] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542b0350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542b0350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x542b0350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="2be989a0-16a1-424b-9211-51aa3bb43e5d", cAlternateFileName="2BE989~1")) returned 1 [0041.884] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x17ffec90, ftCreationTime.dwHighDateTime=0x1d3373c, ftLastAccessTime.dwLowDateTime=0x17ffec90, ftLastAccessTime.dwHighDateTime=0x1d3373c, ftLastWriteTime.dwLowDateTime=0x18024df0, ftLastWriteTime.dwHighDateTime=0x1d3373c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fbbe72db-afd8-443b-88dd-64b20388700d", cAlternateFileName="FBBE72~1")) returned 1 [0041.884] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97414b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.884] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xf6455540, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0041.884] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x542fc610, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x542fc610, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xf6455540, ftLastWriteTime.dwHighDateTime=0x1d4ae2c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0041.884] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.884] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0041.884] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="SYNCHIST", cAlternateFileName="")) returned 0 [0041.884] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.884] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37363838, dwReserved1=0x33373939, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0041.884] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.885] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.885] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.885] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8fc0) returned 1 [0041.885] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.885] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.885] GetLastError () returned 0xea [0041.885] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.885] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.886] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.887] SetEndOfFile (hFile=0xe8) returned 1 [0041.887] CloseHandle (hObject=0xe8) returned 1 [0041.887] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.887] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.887] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.887] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.888] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97414b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.888] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97414b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.888] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.888] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1 [0041.888] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.888] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.888] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.888] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0041.888] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.888] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.888] GetLastError () returned 0xea [0041.888] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.889] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.889] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.890] SetEndOfFile (hFile=0xe8) returned 1 [0041.890] CloseHandle (hObject=0xe8) returned 1 [0041.891] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.891] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.891] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.891] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.891] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 1 [0041.891] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97414b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.891] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97414b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.891] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.891] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Speech", cAlternateFileName="")) returned 1 [0041.891] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.892] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.892] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.892] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8fc0) returned 1 [0041.892] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.892] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.892] GetLastError () returned 0xea [0041.892] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.892] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\speech\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.906] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.908] SetEndOfFile (hFile=0xe8) returned 1 [0041.908] CloseHandle (hObject=0xe8) returned 1 [0041.908] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.908] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.908] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.908] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97414b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.908] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97414b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9767610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.908] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97414b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97414b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9767610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.908] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.908] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0041.908] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.909] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.909] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.909] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0041.909] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.909] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.909] GetLastError () returned 0xea [0041.909] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.909] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.911] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.912] SetEndOfFile (hFile=0xe8) returned 1 [0041.912] CloseHandle (hObject=0xe8) returned 1 [0041.912] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.912] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.912] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9767610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9767610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.912] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9767610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9767610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.913] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9767610, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9767610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.913] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="My", cAlternateFileName="")) returned 1 [0041.913] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.913] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.913] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.913] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0041.913] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.913] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.913] GetLastError () returned 0xea [0041.913] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.914] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.914] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.915] SetEndOfFile (hFile=0xf0) returned 1 [0041.915] CloseHandle (hObject=0xf0) returned 1 [0041.915] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.915] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.915] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.915] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.915] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0041.916] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.916] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.916] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.916] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0041.916] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.916] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.916] GetLastError () returned 0xea [0041.916] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.917] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.917] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.918] SetEndOfFile (hFile=0x108) returned 1 [0041.918] CloseHandle (hObject=0x108) returned 1 [0041.918] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0041.918] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.918] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0041.918] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.918] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa978d770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.918] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa978d770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.918] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0041.918] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="CRLs", cAlternateFileName="")) returned 1 [0041.918] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.919] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.919] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.919] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8fc0) returned 1 [0041.919] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0041.919] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.919] GetLastError () returned 0xea [0041.919] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.920] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.920] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.921] SetEndOfFile (hFile=0x108) returned 1 [0041.921] CloseHandle (hObject=0x108) returned 1 [0041.921] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.921] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.921] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.921] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.921] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa978d770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.921] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa978d770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.921] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.921] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="CTLs", cAlternateFileName="")) returned 1 [0041.922] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.922] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.922] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.922] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0041.922] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.922] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.922] GetLastError () returned 0xea [0041.922] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.923] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.923] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.924] SetEndOfFile (hFile=0x108) returned 1 [0041.924] CloseHandle (hObject=0x108) returned 1 [0041.924] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0041.924] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.924] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0041.924] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.924] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa978d770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.924] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa978d770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.925] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0041.925] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa978d770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.925] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa978d770, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa978d770, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa978d770, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.925] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.925] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="My", cAlternateFileName="")) returned 0 [0041.925] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.925] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0041.925] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.925] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.925] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.925] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0041.925] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.926] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.926] GetLastError () returned 0xea [0041.926] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.926] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.927] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.928] SetEndOfFile (hFile=0xe8) returned 1 [0041.928] CloseHandle (hObject=0xe8) returned 1 [0041.928] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.928] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.928] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.928] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.928] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97b38d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.928] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1 [0041.928] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 0 [0041.928] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0041.928] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UProof", cAlternateFileName="")) returned 1 [0041.928] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.929] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.929] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.929] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0041.929] CryptDestroyHash (hHash=0x5c9100) returned 1 [0041.929] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.929] GetLastError () returned 0xea [0041.929] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.929] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.930] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.931] SetEndOfFile (hFile=0xe8) returned 1 [0041.931] CloseHandle (hObject=0xe8) returned 1 [0041.931] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.931] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.931] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.932] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.932] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 1 [0041.932] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97b38d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.932] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97b38d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.932] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.932] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows", cAlternateFileName="")) returned 1 [0041.932] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0041.932] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0041.932] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.932] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0041.932] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.932] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0041.932] GetLastError () returned 0xea [0041.933] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0041.933] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0041.933] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0041.934] SetEndOfFile (hFile=0xe8) returned 1 [0041.934] CloseHandle (hObject=0xe8) returned 1 [0041.934] CryptDestroyKey (hKey=0x5c9100) returned 1 [0041.935] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.935] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0041.935] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.935] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa475d250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa475d250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Cookies", cAlternateFileName="")) returned 1 [0041.935] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.935] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.935] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.935] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0041.935] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.935] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.935] GetLastError () returned 0xea [0041.935] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.936] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.936] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.937] SetEndOfFile (hFile=0xf0) returned 1 [0041.937] CloseHandle (hObject=0xf0) returned 1 [0041.938] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0041.938] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.938] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0041.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa46eae30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa46eae30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa46eae30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt.crypt", cAlternateFileName="5P5NRG~1.CRY")) returned 1 [0041.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa46eae30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa46eae30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa46eae30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@adobe[3].txt.crypt", cAlternateFileName="5P5NRG~2.CRY")) returned 1 [0041.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4710f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4710f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4710f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@demdex[1].txt.crypt", cAlternateFileName="5P5NRG~3.CRY")) returned 1 [0041.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4710f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4710f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4710f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.crypt", cAlternateFileName="5P5NRG~4.CRY")) returned 1 [0041.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4710f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4710f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4710f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@everesttech[1].txt.crypt", cAlternateFileName="5P57E6~1.CRY")) returned 1 [0041.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47370f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47370f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47370f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@google[2].txt.crypt", cAlternateFileName="5PADAA~1.CRY")) returned 1 [0041.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47370f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47370f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47370f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x56, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@ml314[1].txt.crypt", cAlternateFileName="5P1A89~1.CRY")) returned 1 [0041.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47370f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47370f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa475d250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@rlcdn[2].txt.crypt", cAlternateFileName="5P95E5~1.CRY")) returned 1 [0041.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97b38d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x9b4223a0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0041.938] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa48da010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa48da010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 1 [0041.938] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.939] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.939] CryptHashData (hHash=0x5c9040, pbData=0x33e1160, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.939] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8fc0) returned 1 [0041.939] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.939] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.939] GetLastError () returned 0xea [0041.939] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.939] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.940] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.940] SetEndOfFile (hFile=0x108) returned 1 [0041.941] CloseHandle (hObject=0x108) returned 1 [0041.941] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.941] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.941] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.941] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.941] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa475d250, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa475d250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa475d250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.crypt", cAlternateFileName="5P5NRG~1.CRY")) returned 1 [0041.941] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa475d250, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa475d250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47833b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.crypt", cAlternateFileName="5P5NRG~2.CRY")) returned 1 [0041.941] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47833b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47833b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47833b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@adformdsp[1].txt.crypt", cAlternateFileName="5P5NRG~3.CRY")) returned 1 [0041.941] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47833b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47833b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47833b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@adform[1].txt.crypt", cAlternateFileName="5P5NRG~4.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47833b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47833b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47a9510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@adnxs[1].txt.crypt", cAlternateFileName="5PFDB8~1.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47a9510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47a9510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47a9510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@adtech[2].txt.crypt", cAlternateFileName="5P6340~1.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47a9510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47a9510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47a9510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@adtr02[1].txt.crypt", cAlternateFileName="5PC5DF~1.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47a9510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47a9510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47cf670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@advertising[1].txt.crypt", cAlternateFileName="5P4BCB~1.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47cf670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47cf670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47cf670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@api.bing[2].txt.crypt", cAlternateFileName="5PDC44~1.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47cf670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47cf670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47cf670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@at.atwola[1].txt.crypt", cAlternateFileName="5PF2D2~1.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47f57d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47f57d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47f57d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@bing[1].txt.crypt", cAlternateFileName="5P4709~1.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47f57d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47f57d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47f57d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@c.bing[1].txt.crypt", cAlternateFileName="5P0D04~1.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa47f57d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa47f57d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa47f57d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@c.msn[1].txt.crypt", cAlternateFileName="5P65B7~1.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa481b930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa481b930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa481b930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@doubleclick[2].txt.crypt", cAlternateFileName="5P74EA~1.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa481b930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa481b930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa481b930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x256, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@google[1].txt.crypt", cAlternateFileName="5P96DA~1.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa481b930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa481b930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4841a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@google[3].txt.crypt", cAlternateFileName="5PECE9~1.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4841a90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4841a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4841a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x21f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@google[4].txt.crypt", cAlternateFileName="5P678E~1.CRY")) returned 1 [0041.942] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4841a90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4841a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4841a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@linkedin[1].txt.crypt", cAlternateFileName="5P87D5~1.CRY")) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4841a90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4841a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4867bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@m.exactag[1].txt.crypt", cAlternateFileName="5PD233~1.CRY")) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4867bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4867bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4867bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@msn[1].txt.crypt", cAlternateFileName="5P4195~1.CRY")) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4867bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4867bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4867bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.crypt", cAlternateFileName="5P5E8D~1.CRY")) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa4867bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4867bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa488dd50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.crypt", cAlternateFileName="5P4D92~1.CRY")) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa488dd50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa488dd50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa488dd50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x68, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@skadtec[1].txt.crypt", cAlternateFileName="5P7396~1.CRY")) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa488dd50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa488dd50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa488dd50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@track.adform[2].txt.crypt", cAlternateFileName="5PCF72~1.CRY")) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa488dd50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa488dd50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa48b3eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@www.bing[2].txt.crypt", cAlternateFileName="5P173B~1.CRY")) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa48b3eb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa48b3eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa48b3eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.crypt", cAlternateFileName="5PCE2F~1.CRY")) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa48b3eb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa48b3eb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa48b3eb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5nrgjn0js_halpmcxz@www.msn[2].txt.crypt", cAlternateFileName="5PCF6F~1.CRY")) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97b38d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 0 [0041.943] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2bc9ae40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa48da010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa48da010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 0 [0041.943] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97b38d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97b38d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97b38d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.943] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0041.943] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.944] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.944] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.944] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0041.944] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0041.944] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.944] GetLastError () returned 0xea [0041.944] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.944] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\iecompatcache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.945] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.946] SetEndOfFile (hFile=0xf0) returned 1 [0041.946] CloseHandle (hObject=0xf0) returned 1 [0041.946] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.946] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.946] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97d9a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97d9a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.946] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97d9a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97d9a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.947] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97d9a30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97d9a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97d9a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.947] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 1 [0041.947] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.947] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.947] CryptHashData (hHash=0x5c8ec0, pbData=0x1fc6440, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.947] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0041.947] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0041.947] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.947] GetLastError () returned 0xea [0041.947] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.948] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\iecompatcache\\low\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.948] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.949] SetEndOfFile (hFile=0x108) returned 1 [0041.949] CloseHandle (hObject=0x108) returned 1 [0041.949] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.949] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.949] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97d9a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97d9a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.949] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97d9a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97d9a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.949] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97d9a30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97d9a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97d9a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.949] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97d9a30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97d9a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97d9a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.950] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.950] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 0 [0041.950] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.950] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1 [0041.950] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.950] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.950] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.950] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0041.950] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.950] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.950] GetLastError () returned 0xea [0041.950] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.951] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.951] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.952] SetEndOfFile (hFile=0xf0) returned 1 [0041.952] CloseHandle (hObject=0xf0) returned 1 [0041.952] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.952] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.952] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97d9a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97d9a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.952] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97d9a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97d9a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.952] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97d9a30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97d9a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97d9a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.952] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x83c55340, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0041.952] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 1 [0041.952] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.953] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.953] CryptHashData (hHash=0x5c8fc0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.953] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0041.953] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.953] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.953] GetLastError () returned 0xea [0041.953] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.954] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.954] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.955] SetEndOfFile (hFile=0x108) returned 1 [0041.955] CloseHandle (hObject=0x108) returned 1 [0041.955] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0041.955] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.955] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97d9a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97d9a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0041.955] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97d9a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97d9a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.955] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97d9a30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97d9a30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97d9a30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.955] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0041.955] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0dcf10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x64c3a3c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 0 [0041.955] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0041.956] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f0dcf10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f0dcf10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 0 [0041.956] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.956] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa48da010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa48da010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0041.956] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.956] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.956] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.956] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0041.956] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.956] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.956] GetLastError () returned 0xea [0041.956] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.957] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\libraries\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.958] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.959] SetEndOfFile (hFile=0xf0) returned 1 [0041.959] CloseHandle (hObject=0xf0) returned 1 [0041.959] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0041.959] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.959] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0041.960] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.960] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa48da010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa48da010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa48da010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0041.960] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d1e12e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1 [0041.960] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97ffb90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.960] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d22d5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1 [0041.960] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe23, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1 [0041.960] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1 [0041.960] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d207440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0041.960] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0041.960] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0041.960] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.961] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.961] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.961] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0041.961] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0041.961] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.961] GetLastError () returned 0xea [0041.961] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.961] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\network shortcuts\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.962] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.963] SetEndOfFile (hFile=0xf0) returned 1 [0041.963] CloseHandle (hObject=0xf0) returned 1 [0041.963] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.963] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.963] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.963] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.963] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97ffb90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.963] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97ffb90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.963] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.963] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0041.964] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.964] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.964] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.964] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0041.964] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.964] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.964] GetLastError () returned 0xea [0041.964] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.965] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\printer shortcuts\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.966] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.967] SetEndOfFile (hFile=0xf0) returned 1 [0041.967] CloseHandle (hObject=0xf0) returned 1 [0041.967] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0041.967] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.967] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0041.967] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.967] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97ffb90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.967] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97ffb90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.967] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0041.967] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x94fde710, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0041.968] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.968] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.968] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.968] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0041.968] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0041.968] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.968] GetLastError () returned 0xea [0041.968] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.969] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.969] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.970] SetEndOfFile (hFile=0xf0) returned 1 [0041.970] CloseHandle (hObject=0xf0) returned 1 [0041.970] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.970] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.970] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.971] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.971] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97ffb90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.971] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x94fde710, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x94fde710, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0041.971] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 1 [0041.971] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.972] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.972] CryptHashData (hHash=0x5c8ec0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.972] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8fc0) returned 1 [0041.972] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0041.972] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.972] GetLastError () returned 0xea [0041.972] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.972] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.972] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.973] SetEndOfFile (hFile=0x108) returned 1 [0041.973] CloseHandle (hObject=0x108) returned 1 [0041.974] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.974] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.974] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.974] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.974] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa97ffb90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa97ffb90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa97ffb90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.974] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0041.974] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x50fa8bb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 0 [0041.974] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.974] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50fa8bb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50fa8bb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 0 [0041.974] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.974] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa52abad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52abad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Recent", cAlternateFileName="")) returned 1 [0041.974] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.975] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.975] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.975] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0041.975] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.975] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.975] GetLastError () returned 0xea [0041.975] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.975] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.976] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.977] SetEndOfFile (hFile=0xf0) returned 1 [0041.977] CloseHandle (hObject=0xf0) returned 1 [0041.977] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0041.977] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.977] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9825cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9825cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0041.977] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9825cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9825cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.977] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa48da010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa48da010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4900170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1429, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0hBeYEF7Ft4.mkv.lnk.crypt", cAlternateFileName="0HBEYE~1.CRY")) returned 1 [0041.977] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4900170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4900170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa49262d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1k4R.lnk.crypt", cAlternateFileName="1K4RLN~1.CRY")) returned 1 [0041.977] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa49262d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa49262d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa49262d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1lgdOtiNG.lnk.crypt", cAlternateFileName="1LGDOT~1.CRY")) returned 1 [0041.977] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa49262d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa49262d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa49262d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="2-v8OsluyXo6NQ.lnk.crypt", cAlternateFileName="2-V8OS~1.CRY")) returned 1 [0041.977] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa49262d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa49262d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4bf9cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="20w83dwa.lnk.crypt", cAlternateFileName="20W83D~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4bf9cf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4bf9cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4c45fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="2Qy9fNpQyCJ 70GH9.lnk.crypt", cAlternateFileName="2QY9FN~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c45fb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4c45fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4c6c110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1002, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="2YTf5ryi8j8c45B6Xqk1.lnk.crypt", cAlternateFileName="2YTF5R~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c6c110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4c6c110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4c6c110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa88, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="3bgp1RW3KcVuB5mMAG.lnk.crypt", cAlternateFileName="3BGP1R~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c6c110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4c6c110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4c6c110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="4WR0EV8pyK_9X.lnk.crypt", cAlternateFileName="4WR0EV~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c6c110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4c6c110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4c92270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf31, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="63lPZq3SNnHAORv23yF.flv.lnk.crypt", cAlternateFileName="63LPZQ~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c92270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4c92270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4c92270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="6AMH.mkv.lnk.crypt", cAlternateFileName="6AMHMK~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c92270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4c92270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4c92270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3b6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="6c5qlTBS.lnk.crypt", cAlternateFileName="6C5QLT~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4cb83d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4cb83d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4cb83d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7H_dTpHa.lnk.crypt", cAlternateFileName="7H_DTP~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4cb83d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4cb83d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4cde530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa7a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7pxElmPL-Wwhu0MBGln.lnk.crypt", cAlternateFileName="7PXELM~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4cde530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4cde530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4cde530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7r-1o.lnk.crypt", cAlternateFileName="7R-1OL~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4cde530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4cde530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4cde530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="a zSKVxRNzq.lnk.crypt", cAlternateFileName="AZSKVX~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4cde530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4cde530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4d04690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ACyV4Fg44jp6azL.lnk.crypt", cAlternateFileName="ACYV4F~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d04690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4d04690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4d04690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="aIhTDD.lnk.crypt", cAlternateFileName="AIHTDD~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d2a7f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4d2a7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4d2a7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ALdqrxGRhqPLE.flv.lnk.crypt", cAlternateFileName="ALDQRX~1.CRY")) returned 1 [0041.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0041.978] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.979] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.979] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.979] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0041.979] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.979] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.979] GetLastError () returned 0xea [0041.979] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.979] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.979] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.980] SetEndOfFile (hFile=0x108) returned 1 [0041.981] CloseHandle (hObject=0x108) returned 1 [0041.981] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0041.981] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.981] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9825cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9825cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0041.981] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9825cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9825cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x991c3660, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa5f178d0, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9825cf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9825cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9825cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9825cf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9825cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9825cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.981] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d2a7f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4d2a7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4d2a7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13f2, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="av6EJhj6daw.flv.lnk.crypt", cAlternateFileName="AV6EJH~1.CRY")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d2a7f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4d2a7f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4d2a7f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="b ylBYEH0cothr-.lnk.crypt", cAlternateFileName="BYLBYE~1.CRY")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d50950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4d50950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4d50950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x31a, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="B320plYDi698XfAex.lnk.crypt", cAlternateFileName="B320PL~1.CRY")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d50950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4d50950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4d76ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf10, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="B77Jv1PcIX8nKuV-.mkv.lnk.crypt", cAlternateFileName="B77JV1~1.CRY")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d76ab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4d76ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4d76ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="BEOeKw eDuhD3.lnk.crypt", cAlternateFileName="BEOEKW~1.CRY")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d76ab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4d76ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4d76ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="bhUHT.lnk.crypt", cAlternateFileName="BHUHTL~1.CRY")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d76ab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4d76ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4d9cc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f9, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="BTGLO1I4z9S60.mkv.lnk.crypt", cAlternateFileName="BTGLO1~1.CRY")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9cc10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4d9cc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4d9cc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Ck22L.lnk.crypt", cAlternateFileName="CK22LL~1.CRY")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9cc10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4d9cc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4d9cc10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x144b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="clzlnKg2DDD.mkv.lnk.crypt", cAlternateFileName="CLZLNK~1.CRY")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9cc10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4d9cc10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4dc2d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="cSpgQsUvdWcqqW_4G8m.lnk.crypt", cAlternateFileName="CSPGQS~1.CRY")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4dc2d70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4dc2d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4dc2d70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="ctgIJ7lZLN2CGput Xl.ots.lnk.crypt", cAlternateFileName="CTGIJ7~1.CRY")) returned 1 [0041.981] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0041.981] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0041.982] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0041.982] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.982] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0041.982] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0041.982] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0041.982] GetLastError () returned 0xea [0041.982] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0041.982] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0041.984] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0041.985] SetEndOfFile (hFile=0x108) returned 1 [0041.985] CloseHandle (hObject=0x108) returned 1 [0041.985] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.985] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.985] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9825cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9825cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.985] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9825cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9825cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.985] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0041.985] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0041.985] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0041.985] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 1 [0041.985] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0041.985] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 1 [0041.985] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 1 [0041.985] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9825cf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9825cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9825cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.985] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9825cf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9825cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9825cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0041.985] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4dc2d70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4dc2d70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4e0f030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="czX2gsVPMSP9d.lnk.crypt", cAlternateFileName="CZX2GS~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e0f030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4e0f030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4e0f030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="D0zcRpw_caOcZNoV4mkG.lnk.crypt", cAlternateFileName="D0ZCRP~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e0f030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4e0f030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4e35190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e35190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4e35190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4e35190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="DXvVoXwv.lnk.crypt", cAlternateFileName="DXVVOX~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e35190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4e35190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4e35190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa06, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="EbgPE9V15_kcIv3u6EhR.lnk.crypt", cAlternateFileName="EBGPE9~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e35190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4e35190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4e5b2f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="eMhUXRXBgUglxcn3.lnk.crypt", cAlternateFileName="EMHUXR~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e5b2f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4e5b2f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4e5b2f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa47, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="eovezfgn1Aazt5.lnk.crypt", cAlternateFileName="EOVEZF~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e5b2f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4e5b2f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4e5b2f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="et hDjezCTkvEK.lnk.crypt", cAlternateFileName="ETHDJE~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e5b2f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4e5b2f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4e81450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa0b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="fgkJ1j.lnk.crypt", cAlternateFileName="FGKJ1J~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e81450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4e81450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4e81450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa22, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="FtJuB8_WULa.lnk.crypt", cAlternateFileName="FTJUB8~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e81450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4e81450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4e81450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa72, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Gepf8q naWWdA3Hh.lnk.crypt", cAlternateFileName="GEPF8Q~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e81450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4e81450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4ea75b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="gjcKm.lnk.crypt", cAlternateFileName="GJCKML~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ea75b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4ea75b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4ea75b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="gOVPRFjodhzZVtG.lnk.crypt", cAlternateFileName="GOVPRF~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ea75b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4ea75b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4ea75b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf55, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="grU9T.lnk.crypt", cAlternateFileName="GRU9TL~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ea75b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4ea75b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4ecd710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="gWma.lnk.crypt", cAlternateFileName="GWMALN~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9825cf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9825cf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9825cf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecd710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4ecd710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4ecd710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="I f1ZnX-HR.lnk.crypt", cAlternateFileName="IF1ZNX~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecd710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4ecd710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4ecd710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="I8sW8qFtvHq_OBx.lnk.crypt", cAlternateFileName="I8SW8Q~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ecd710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4ecd710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4ef3870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IJ5_x.flv.lnk.crypt", cAlternateFileName="IJ5_XF~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ef3870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4ef3870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4ef3870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="itujVDK1.lnk.crypt", cAlternateFileName="ITUJVD~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ef3870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4ef3870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4ef3870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="ixcTUA2MdhOdrM8T-je.lnk.crypt", cAlternateFileName="IXCTUA~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ef3870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4ef3870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4f199d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="J3ZkluwvkiGXI8r-B5.lnk.crypt", cAlternateFileName="J3ZKLU~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f199d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4f199d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4f199d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa9e, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="jFlm5M5isN1V6QsQFljh.lnk.crypt", cAlternateFileName="JFLM5M~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f199d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4f199d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4f199d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1481, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="jqW0-oJ-hD7GVCfIZGQ.mkv.lnk.crypt", cAlternateFileName="JQW0-O~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f199d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4f199d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4f3fb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x252, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="jzvXZWBC2RYZP.lnk.crypt", cAlternateFileName="JZVXZW~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f3fb30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4f3fb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4f3fb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13bf, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="kGd4Dp.flv.lnk.crypt", cAlternateFileName="KGD4DP~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f3fb30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4f3fb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4f3fb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="L32hcyZtEpundH.lnk.crypt", cAlternateFileName="L32HCY~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f3fb30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4f3fb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4f65c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="lAQFBeUeHy.lnk.crypt", cAlternateFileName="LAQFBE~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f65c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4f65c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4f65c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="LcEzmMI.lnk.crypt", cAlternateFileName="LCEZMM~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f65c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4f65c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4f65c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="LmtSVhfzw.lnk.crypt", cAlternateFileName="LMTSVH~1.CRY")) returned 1 [0041.986] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f65c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4f65c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4f65c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="lovM7zTe54ZDP.lnk.crypt", cAlternateFileName="LOVM7Z~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f8bdf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4f8bdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4f8bdf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe71, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="LuoppkTQnaUtW.lnk.crypt", cAlternateFileName="LUOPPK~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4f8bdf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4f8bdf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4fb1f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x98f, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="m1LcNfC15e9dwL.lnk.crypt", cAlternateFileName="M1LCNF~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fb1f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4fb1f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4fb1f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="m1sLm.lnk.crypt", cAlternateFileName="M1SLML~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fb1f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4fb1f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4fb1f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9d5, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="McWc.lnk.crypt", cAlternateFileName="MCWCLN~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fb1f50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4fb1f50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4fb1f50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="moa2K41f.lnk.crypt", cAlternateFileName="MOA2K4~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fd80b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4fd80b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4fd80b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MuwQtWu1bqcJz_nr_4.lnk.crypt", cAlternateFileName="MUWQTW~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fd80b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4fd80b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4fd80b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="My Music.lnk.crypt", cAlternateFileName="MYMUSI~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fd80b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4fd80b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4ffe210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="My Pictures.lnk.crypt", cAlternateFileName="MYPICT~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ffe210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4ffe210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4ffe210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="My Videos.lnk.crypt", cAlternateFileName="MYVIDE~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ffe210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4ffe210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa4ffe210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf68, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="N0tyvu.lnk.crypt", cAlternateFileName="N0TYVU~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ffe210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa4ffe210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5024370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="nI67Wp8LP7.lnk.crypt", cAlternateFileName="NI67WP~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5024370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5024370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5024370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Ni_8L4qj1FGdbSRxn.lnk.crypt", cAlternateFileName="NI_8L4~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5024370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5024370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5024370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="nJaxoH3z6.lnk.crypt", cAlternateFileName="NJAXOH~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5024370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5024370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5024370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="nL2dk-97jFEcTR.lnk.crypt", cAlternateFileName="NL2DK-~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5024370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5024370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa504a4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="NmYHleAHvhFUD.lnk.crypt", cAlternateFileName="NMYHLE~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa504a4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa504a4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa504a4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa72, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="NPyBn4PYfD0Uer9-.lnk.crypt", cAlternateFileName="NPYBN4~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa504a4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa504a4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa504a4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9cd, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="NvfRbKM-Q.flv.lnk.crypt", cAlternateFileName="NVFRBK~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa504a4d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa504a4d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa504a4d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2d5, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="nVlL.lnk.crypt", cAlternateFileName="NVLLLN~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5070630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5070630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5070630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x93b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="O4Yqd.lnk.crypt", cAlternateFileName="O4YQDL~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5070630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5070630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5070630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2e6, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="oE_MoJA.lnk.crypt", cAlternateFileName="OE_MOJ~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5070630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5070630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5070630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="PnJy.lnk.crypt", cAlternateFileName="PNJYLN~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5070630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5070630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5096790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1414, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="PVcYf9.flv.lnk.crypt", cAlternateFileName="PVCYF9~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5096790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5096790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5096790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa73, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Qc87LZYu5MnLTcCw5Q.lnk.crypt", cAlternateFileName="QC87LZ~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5096790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5096790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5096790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf85, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="QFEDUHr5Z.lnk.crypt", cAlternateFileName="QFEDUH~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5096790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5096790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5096790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x992, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="QvXt.mkv.lnk.crypt", cAlternateFileName="QVXTMK~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa50bc8f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa50bc8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa50bc8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa07, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="QWKwKdI.lnk.crypt", cAlternateFileName="QWKWKD~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa50bc8f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa50bc8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa50bc8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa64, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="rfTi4jYQDV0uM8w0K.lnk.crypt", cAlternateFileName="RFTI4J~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa50bc8f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa50bc8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa50bc8f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="rgIcyANdL2Redj9.flv.lnk.crypt", cAlternateFileName="RGICYA~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa50bc8f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa50bc8f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa50e2a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa30, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="RJTkAx3XvY.lnk.crypt", cAlternateFileName="RJTKAX~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa50e2a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa50e2a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa50e2a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="RMAlosi.lnk.crypt", cAlternateFileName="RMALOS~1.CRY")) returned 1 [0041.987] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa50e2a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa50e2a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa50e2a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Roaming.lnk.crypt", cAlternateFileName="ROAMIN~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa50e2a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa50e2a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa50e2a50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="RrY6.mkv.lnk.crypt", cAlternateFileName="RRY6MK~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa50e2a50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa50e2a50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5108bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa37, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="RsbC_5Xwws.lnk.crypt", cAlternateFileName="RSBC_5~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5108bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5108bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5108bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="RTNc lp7dm74RUn.lnk.crypt", cAlternateFileName="RTNCLP~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5108bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5108bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5108bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3aa, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="rv__7l.lnk.crypt", cAlternateFileName="RV__7L~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5108bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5108bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5108bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="snpq5514f5VxwNHMTa.lnk.crypt", cAlternateFileName="SNPQ55~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa512ed10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa512ed10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa512ed10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="svF1qlhEpB-.ots.lnk.crypt", cAlternateFileName="SVF1QL~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa512ed10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa512ed10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa512ed10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="SYrO3Uqr5m.lnk.crypt", cAlternateFileName="SYRO3U~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa512ed10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa512ed10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa512ed10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe5f, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="t6Ybl35E-1WGC.mkv.lnk.crypt", cAlternateFileName="T6YBL3~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa512ed10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa512ed10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5154e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf68, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="tlYEuU.lnk.crypt", cAlternateFileName="TLYEUU~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5154e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5154e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5154e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf85, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="tMuxzgPEV.lnk.crypt", cAlternateFileName="TMUXZG~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5154e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5154e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5154e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="tSfS3txBVOn8wL_501.lnk.crypt", cAlternateFileName="TSFS3T~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5154e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5154e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5154e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="uea73UW-Qa5hA_JDTHP.lnk.crypt", cAlternateFileName="UEA73U~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa517afd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa517afd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa517afd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x90a, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UIN.lnk.crypt", cAlternateFileName="UINLNK~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa517afd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa517afd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa517afd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1482, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Ur1x3_10TLgwqBBy.flv.lnk.crypt", cAlternateFileName="UR1X3_~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa517afd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa517afd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa517afd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe5b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="v4noN7O sKB.lnk.crypt", cAlternateFileName="V4NON7~1.CRY")) returned 1 [0041.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa517afd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa517afd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa51a1130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="vaCw.lnk.crypt", cAlternateFileName="VACWLN~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa51a1130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa51a1130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa51a1130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xe3a, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="vd8DgU1S.lnk.crypt", cAlternateFileName="VD8DGU~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa51a1130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa51a1130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa51a1130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="VGGDFIdk-R.lnk.crypt", cAlternateFileName="VGGDFI~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa51a1130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa51a1130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa51a1130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa05, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="VHqzI_mN.lnk.crypt", cAlternateFileName="VHQZI_~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa51c7290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa51c7290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa51c7290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa88, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="vinoLwfUsbpS4BWLGW.lnk.crypt", cAlternateFileName="VINOLW~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa51c7290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa51c7290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa51c7290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="VyfcFK-R3a9.lnk.crypt", cAlternateFileName="VYFCFK~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa51c7290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa51c7290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa51c7290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Wb85quJcmU45C5T.lnk.crypt", cAlternateFileName="WB85QU~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa51c7290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa51c7290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa51ed3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="wkTfHmhLJX51r8i6Q.lnk.crypt", cAlternateFileName="WKTFHM~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa51ed3f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa51ed3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa51ed3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf9b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="WPT7UafYBGl.lnk.crypt", cAlternateFileName="WPT7UA~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa51ed3f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa51ed3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa51ed3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="wt5bUzyysPD.lnk.crypt", cAlternateFileName="WT5BUZ~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa51ed3f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa51ed3f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa51ed3f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="WZ3imSrZcPAEZqerhj.lnk.crypt", cAlternateFileName="WZ3IMS~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5213550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5213550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5213550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="x5-hMMhjBt-u0xNu.flv.lnk.crypt", cAlternateFileName="X5-HMM~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5213550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5213550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5213550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="X53u2qVjhd-p.lnk.crypt", cAlternateFileName="X53U2Q~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5213550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5213550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5213550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="XCE6mWPwu1m.lnk.crypt", cAlternateFileName="XCE6MW~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5213550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5213550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52396b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="XsD0o5hKl2npcDCg2IIF.lnk.crypt", cAlternateFileName="XSD0O5~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52396b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52396b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52396b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="xt_DmRSH-_4BV2SH9.ots.lnk.crypt", cAlternateFileName="XT_DMR~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52396b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52396b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52396b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="XU7TpXHMTpi3hxEYx5.lnk.crypt", cAlternateFileName="XU7TPX~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52396b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52396b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52396b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="xWeKX.lnk.crypt", cAlternateFileName="XWEKXL~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa525f810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa525f810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa525f810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="XY9FEIK2DpgtI.lnk.crypt", cAlternateFileName="XY9FEI~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa525f810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa525f810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa525f810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2f2, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="yPs6sZU6g.lnk.crypt", cAlternateFileName="YPS6SZ~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa525f810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa525f810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa525f810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="YVs8isf1eAN_oRcfI.mkv.lnk.crypt", cAlternateFileName="YVS8IS~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa525f810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa525f810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5285970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa72, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="YxcWeP1oYdIJLC6u.lnk.crypt", cAlternateFileName="YXCWEP~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5285970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5285970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5285970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Z1wt.lnk.crypt", cAlternateFileName="Z1WTLN~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5285970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5285970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5285970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="ZBK1QvsIC2F.lnk.crypt", cAlternateFileName="ZBK1QV~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5285970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5285970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5285970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="zGYsNXFxx3.lnk.crypt", cAlternateFileName="ZGYSNX~1.CRY")) returned 1 [0041.989] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52abad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52abad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52abad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_zV ld0rkKX1LQg7da.lnk.crypt", cAlternateFileName="_ZVLD0~1.CRY")) returned 1 [0041.990] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52abad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52abad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52abad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="_zV ld0rkKX1LQg7da.lnk.crypt", cAlternateFileName="_ZVLD0~1.CRY")) returned 0 [0041.990] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0041.990] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa52d1c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52d1c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67514c31, dwReserved1=0x2e616437, cFileName="SendTo", cAlternateFileName="")) returned 1 [0041.990] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.990] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.990] CryptHashData (hHash=0x5c8fc0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.990] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0041.990] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0041.990] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.990] GetLastError () returned 0xea [0041.990] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.991] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\sendto\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0041.991] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0041.992] SetEndOfFile (hFile=0xf0) returned 1 [0041.992] CloseHandle (hObject=0xf0) returned 1 [0041.992] CryptDestroyKey (hKey=0x5c9040) returned 1 [0041.992] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0041.992] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa984be50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa984be50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0041.992] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa984be50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa984be50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0041.992] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0041.992] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0041.992] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa52abad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52abad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52abad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0041.992] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1 [0041.993] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa52abad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52abad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52abad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Fax Recipient.lnk.crypt", cAlternateFileName="FAXREC~1.CRY")) returned 1 [0041.993] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa984be50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa984be50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa984be50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0041.993] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0041.993] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0041.993] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0041.993] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa52d1c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52d1c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0041.993] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0041.993] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0041.993] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0041.993] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0041.993] CryptDestroyHash (hHash=0x5c9040) returned 1 [0041.993] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0041.993] GetLastError () returned 0xea [0041.993] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0041.994] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.006] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.008] SetEndOfFile (hFile=0xf0) returned 1 [0042.009] CloseHandle (hObject=0xf0) returned 1 [0042.009] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.009] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.009] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9871fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9871fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.009] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9871fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9871fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.009] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52d1c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52d1c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52d1c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.009] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa984be50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa984be50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9871fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.009] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa53dc5d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa53dc5d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Programs", cAlternateFileName="")) returned 1 [0042.009] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0042.010] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0042.010] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.010] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0042.010] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.010] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0042.010] GetLastError () returned 0xea [0042.010] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0042.011] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.012] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0042.013] SetEndOfFile (hFile=0x108) returned 1 [0042.014] CloseHandle (hObject=0x108) returned 1 [0042.014] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.014] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.014] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9871fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9871fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.014] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9871fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9871fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.014] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa53b6470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa53b6470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0042.014] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0042.015] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0042.015] CryptHashData (hHash=0x5c9040, pbData=0x1fe5350, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.015] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9000) returned 1 [0042.015] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.015] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0042.015] GetLastError () returned 0xea [0042.015] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0042.015] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0042.017] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.018] SetEndOfFile (hFile=0x114) returned 1 [0042.019] CloseHandle (hObject=0x114) returned 1 [0042.019] CryptDestroyKey (hKey=0x5c9000) returned 1 [0042.019] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.019] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9871fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9871fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0042.019] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9871fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9871fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.019] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa531def0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa531def0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0042.019] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0042.020] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0042.020] CryptHashData (hHash=0x5c9040, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.020] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c91c0) returned 1 [0042.020] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.020] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18e808) returned 0 [0042.020] GetLastError () returned 0xea [0042.020] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18e804*=0x260) returned 1 [0042.021] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.022] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0042.023] SetEndOfFile (hFile=0x104) returned 1 [0042.025] CloseHandle (hObject=0x104) returned 1 [0042.025] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.025] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.025] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9898110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9898110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.025] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9898110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9898110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.025] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52d1c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52d1c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52d1c30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.025] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52d1c30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52d1c30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52f7d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ease of Access.lnk.crypt", cAlternateFileName="EASEOF~1.CRY")) returned 1 [0042.025] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9898110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9898110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9898110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.025] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52f7d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52f7d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52f7d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Magnify.lnk.crypt", cAlternateFileName="MAGNIF~1.CRY")) returned 1 [0042.025] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52f7d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52f7d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa52f7d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Narrator.lnk.crypt", cAlternateFileName="NARRAT~1.CRY")) returned 1 [0042.025] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52f7d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52f7d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa531def0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="On-Screen Keyboard.lnk.crypt", cAlternateFileName="ON-SCR~1.CRY")) returned 1 [0042.025] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52f7d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa52f7d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa531def0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="On-Screen Keyboard.lnk.crypt", cAlternateFileName="ON-SCR~1.CRY")) returned 0 [0042.025] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.025] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa531def0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa531def0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa531def0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="Command Prompt.lnk.crypt", cAlternateFileName="COMMAN~1.CRY")) returned 1 [0042.025] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa531def0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa531def0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa531def0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.025] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9871fb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9871fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9871fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.025] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5344050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5344050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5344050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="Notepad.lnk.crypt", cAlternateFileName="NOTEPA~1.CRY")) returned 1 [0042.025] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5344050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5344050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5344050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="Run.lnk.crypt", cAlternateFileName="RUNLNK~1.CRY")) returned 1 [0042.025] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5390310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5390310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0042.026] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0042.026] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0042.026] CryptHashData (hHash=0x5c91c0, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.026] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9040) returned 1 [0042.026] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.026] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18e808) returned 0 [0042.026] GetLastError () returned 0xea [0042.026] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18e804*=0x260) returned 1 [0042.027] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.028] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0042.029] SetEndOfFile (hFile=0x104) returned 1 [0042.030] CloseHandle (hObject=0x104) returned 1 [0042.030] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.030] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.030] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9898110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9898110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.030] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9898110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9898110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.031] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5344050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5344050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa536a1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="computer.lnk.crypt", cAlternateFileName="COMPUT~1.CRY")) returned 1 [0042.031] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa536a1b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa536a1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa536a1b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Control Panel.lnk.crypt", cAlternateFileName="CONTRO~1.CRY")) returned 1 [0042.031] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa536a1b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa536a1b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5390310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.031] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9898110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9898110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9898110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.031] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5390310, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5390310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5390310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5df, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Internet Explorer (No Add-ons).lnk.crypt", cAlternateFileName="INTERN~1.CRY")) returned 1 [0042.031] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5390310, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5390310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5390310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Private Character Editor.lnk.crypt", cAlternateFileName="PRIVAT~1.CRY")) returned 1 [0042.031] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5390310, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5390310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5390310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Private Character Editor.lnk.crypt", cAlternateFileName="PRIVAT~1.CRY")) returned 0 [0042.031] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.031] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa53b6470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa53b6470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa53b6470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 1 [0042.031] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa53b6470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa53b6470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa53b6470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 0 [0042.031] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0042.031] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa53b6470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa53b6470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f6c, dwReserved1=0x6e6c2e72, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0042.031] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0042.032] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0042.032] CryptHashData (hHash=0x5c9000, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.032] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0042.032] CryptDestroyHash (hHash=0x5c9000) returned 1 [0042.032] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0042.032] GetLastError () returned 0xea [0042.032] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0042.032] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0042.034] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.035] SetEndOfFile (hFile=0x114) returned 1 [0042.036] CloseHandle (hObject=0x114) returned 1 [0042.036] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.036] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.036] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9898110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9898110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.036] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9898110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9898110, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.036] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa53b6470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa53b6470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa53b6470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.036] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9898110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9898110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98be270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.037] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9898110, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9898110, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98be270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.037] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.037] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa53b6470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa53b6470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa53dc5d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.037] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9871fb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9871fb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9871fb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.037] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa53dc5d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa53dc5d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa53dc5d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Internet Explorer (64-bit).lnk.crypt", cAlternateFileName="INTERN~1.CRY")) returned 1 [0042.037] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa53dc5d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa53dc5d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa53dc5d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Internet Explorer.lnk.crypt", cAlternateFileName="INTERN~2.CRY")) returned 1 [0042.037] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5402730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5402730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0042.037] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0042.038] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0042.038] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.038] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9000) returned 1 [0042.038] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.038] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0042.038] GetLastError () returned 0xea [0042.038] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0042.038] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0042.042] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.043] SetEndOfFile (hFile=0x114) returned 1 [0042.044] CloseHandle (hObject=0x114) returned 1 [0042.044] CryptDestroyKey (hKey=0x5c9000) returned 1 [0042.044] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.044] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa98be270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98be270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0042.044] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa98be270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98be270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.044] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa53dc5d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa53dc5d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5402730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.044] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5402730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5402730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5402730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Help.lnk.crypt", cAlternateFileName="HELPLN~1.CRY")) returned 1 [0042.044] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa98be270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa98be270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98be270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.045] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa98be270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa98be270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98be270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.045] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0042.045] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5402730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5402730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Startup", cAlternateFileName="")) returned 1 [0042.045] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0042.045] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0042.045] CryptHashData (hHash=0x5c9000, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.045] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9040) returned 1 [0042.045] CryptDestroyHash (hHash=0x5c9000) returned 1 [0042.045] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0042.046] GetLastError () returned 0xea [0042.046] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0042.046] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0042.047] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.048] SetEndOfFile (hFile=0x114) returned 1 [0042.049] CloseHandle (hObject=0x114) returned 1 [0042.049] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.049] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.049] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa98be270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98be270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.049] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa98be270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98be270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.050] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5402730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5402730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5402730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.050] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa98be270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa98be270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98be270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.050] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa98be270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa98be270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98be270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.050] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.050] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5402730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5402730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Startup", cAlternateFileName="")) returned 0 [0042.050] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.050] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa53dc5d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa53dc5d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Programs", cAlternateFileName="")) returned 0 [0042.050] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.050] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0042.050] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.061] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.061] CryptHashData (hHash=0x5c8fc0, pbData=0x33e1160, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.061] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0042.061] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.061] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0042.061] GetLastError () returned 0xea [0042.061] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.062] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\templates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.063] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.064] SetEndOfFile (hFile=0xf0) returned 1 [0042.064] CloseHandle (hObject=0xf0) returned 1 [0042.064] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.064] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.064] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa98e43d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98e43d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.065] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa98e43d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98e43d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.065] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa98e43d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa98e43d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98e43d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.065] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa98e43d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa98e43d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa98e43d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.065] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.065] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa549acb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa549acb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Themes", cAlternateFileName="")) returned 1 [0042.065] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.066] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.066] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.066] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0042.066] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.066] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0042.066] GetLastError () returned 0xea [0042.066] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.066] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.067] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.068] SetEndOfFile (hFile=0xf0) returned 1 [0042.068] CloseHandle (hObject=0xf0) returned 1 [0042.068] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.068] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.068] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.068] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.068] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa990a530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.068] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5428890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5428890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa549acb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="TranscodedWallpaper.jpg.crypt", cAlternateFileName="TRANSC~1.CRY")) returned 1 [0042.068] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5428890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5428890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa549acb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9cfab, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="TranscodedWallpaper.jpg.crypt", cAlternateFileName="TRANSC~1.CRY")) returned 0 [0042.068] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.068] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa549acb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa549acb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Themes", cAlternateFileName="")) returned 0 [0042.069] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.069] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x52437374, cFileName="Word", cAlternateFileName="")) returned 1 [0042.069] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.069] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.069] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.069] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8fc0) returned 1 [0042.069] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.069] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0042.070] GetLastError () returned 0xea [0042.070] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.070] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.071] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.072] SetEndOfFile (hFile=0xe8) returned 1 [0042.072] CloseHandle (hObject=0xe8) returned 1 [0042.072] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.072] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.072] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.073] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.073] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa990a530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.073] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="STARTUP", cAlternateFileName="")) returned 1 [0042.073] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.074] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.074] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.074] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0042.074] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.074] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0042.074] GetLastError () returned 0xea [0042.074] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.074] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\startup\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.075] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.076] SetEndOfFile (hFile=0xf0) returned 1 [0042.076] CloseHandle (hObject=0xf0) returned 1 [0042.076] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.076] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.076] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.076] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.076] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa990a530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.076] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa990a530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.076] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.076] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27c7d150, ftCreationTime.dwHighDateTime=0x1d3aaba, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="STARTUP", cAlternateFileName="")) returned 0 [0042.076] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.077] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f71aa70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x27c7d150, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27c7d150, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x75637472, dwReserved1=0x52437374, cFileName="Word", cAlternateFileName="")) returned 0 [0042.077] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.077] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61636966, dwReserved1=0x20736574, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0042.077] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.077] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.077] CryptHashData (hHash=0x5c90c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.077] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8fc0) returned 1 [0042.077] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.077] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f410) returned 0 [0042.077] GetLastError () returned 0xea [0042.077] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.078] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.078] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.079] SetEndOfFile (hFile=0xec) returned 1 [0042.079] CloseHandle (hObject=0xec) returned 1 [0042.079] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.079] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.079] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.079] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.079] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0042.079] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.080] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.080] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.080] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0042.080] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.080] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0042.080] GetLastError () returned 0xea [0042.080] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.080] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\extensions\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.081] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.084] SetEndOfFile (hFile=0xe8) returned 1 [0042.084] CloseHandle (hObject=0xe8) returned 1 [0042.085] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.085] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.085] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.085] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb458e750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.085] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa990a530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9930690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.085] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa990a530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9930690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.085] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.085] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa5559390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5559390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Firefox", cAlternateFileName="")) returned 1 [0042.085] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.086] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.086] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.086] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0042.086] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.086] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18f1a8) returned 0 [0042.086] GetLastError () returned 0xea [0042.086] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.086] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.089] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.090] SetEndOfFile (hFile=0xe8) returned 1 [0042.090] CloseHandle (hObject=0xe8) returned 1 [0042.090] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.090] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.090] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa9930690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9930690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.090] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa9930690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9930690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.090] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Crash Reports", cAlternateFileName="CRASHR~1")) returned 1 [0042.090] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.091] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.091] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.091] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0042.091] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.091] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0042.091] GetLastError () returned 0xea [0042.091] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.092] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.092] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.093] SetEndOfFile (hFile=0xf0) returned 1 [0042.093] CloseHandle (hObject=0xf0) returned 1 [0042.093] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.093] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.093] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa9930690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9930690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.093] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa9930690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9930690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.093] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9930690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9930690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9930690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.093] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 1 [0042.093] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="InstallTime20131025151332", cAlternateFileName="INSTAL~1")) returned 0 [0042.093] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.094] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9930690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9930690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9930690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x33313032, dwReserved1=0x35323031, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.094] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33313032, dwReserved1=0x35323031, cFileName="Profiles", cAlternateFileName="")) returned 1 [0042.094] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.094] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.094] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.094] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0042.094] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.094] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ef40) returned 0 [0042.094] GetLastError () returned 0xea [0042.094] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.095] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.095] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.096] SetEndOfFile (hFile=0xf0) returned 1 [0042.096] CloseHandle (hObject=0xf0) returned 1 [0042.096] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.096] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.096] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa9930690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9930690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.096] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa9930690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9930690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.096] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9930690, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9930690, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9930690, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.096] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa5533230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5533230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 1 [0042.096] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0042.097] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0042.097] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.097] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0042.097] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.097] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ecd8) returned 0 [0042.097] GetLastError () returned 0xea [0042.097] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0042.097] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.098] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0042.099] SetEndOfFile (hFile=0x108) returned 1 [0042.099] CloseHandle (hObject=0x108) returned 1 [0042.099] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.099] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.099] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa99567f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99567f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.099] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa99567f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99567f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.099] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb76a6d10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb76a6d10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb76a6d10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 1 [0042.099] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x8503de70, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x8503de70, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="bookmarkbackups", cAlternateFileName="BOOKMA~1")) returned 1 [0042.099] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0042.100] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0042.100] CryptHashData (hHash=0x5c9100, pbData=0x1fc6440, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.100] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9000) returned 1 [0042.100] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.100] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0042.100] GetLastError () returned 0xea [0042.100] CryptEncrypt (in: hKey=0x5c9000, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0042.100] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0042.101] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.102] SetEndOfFile (hFile=0x114) returned 1 [0042.102] CloseHandle (hObject=0x114) returned 1 [0042.102] CryptDestroyKey (hKey=0x5c9000) returned 1 [0042.103] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.103] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa99567f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99567f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9000 [0042.103] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb5233c30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa99567f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99567f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc37c9330, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc37c9330, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc37df2c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="bookmarks-2017-06-05_5.json", cAlternateFileName="BOOKMA~1.JSO")) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85017d10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x85017d10, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x85017d10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbdb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="bookmarks-2017-06-16_5.json", cAlternateFileName="BOOKMA~2.JSO")) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa99567f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99567f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99567f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x5c9000, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa99567f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99567f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99567f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.103] FindClose (in: hFindFile=0x5c9000 | out: hFindFile=0x5c9000) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb47c9bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb47c9bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="cert8.db", cAlternateFileName="")) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa550d0d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa550d0d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa550d0d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="compatibility.ini.crypt", cAlternateFileName="COMPAT~1.CRY")) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5e8ce50, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5e8ce50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb639bd10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="content-prefs.sqlite", cAlternateFileName="CONTEN~1.SQL")) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb5ad4bf0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5ad4bf0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x83256a10, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="cookies.sqlite", cAlternateFileName="COOKIE~1.SQL")) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbc374ed0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbc374ed0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbc555e20, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="downloads.sqlite", cAlternateFileName="DOWNLO~1.SQL")) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5533230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5533230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5533230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="extensions.ini.crypt", cAlternateFileName="EXTENS~1.CRY")) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb45b48b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb45b48b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb4b0fa30, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x70000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="extensions.sqlite", cAlternateFileName="EXTENS~1.SQL")) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa99567f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99567f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99567f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.103] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="indexedDB", cAlternateFileName="INDEXE~1")) returned 1 [0042.103] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0042.104] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0042.104] CryptHashData (hHash=0x5c9000, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.104] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0042.104] CryptDestroyHash (hHash=0x5c9000) returned 1 [0042.104] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0042.104] GetLastError () returned 0xea [0042.104] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0042.104] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0042.105] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.106] SetEndOfFile (hFile=0x114) returned 1 [0042.106] CloseHandle (hObject=0x114) returned 1 [0042.106] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.106] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.106] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa99567f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99567f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.106] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6ff4f30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa99567f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99567f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.106] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa99567f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99567f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99567f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.106] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 1 [0042.106] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0042.107] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0042.107] CryptHashData (hHash=0x5c9000, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.107] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c91c0) returned 1 [0042.107] CryptDestroyHash (hHash=0x5c9000) returned 1 [0042.107] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18e808) returned 0 [0042.107] GetLastError () returned 0xea [0042.107] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18e804*=0x260) returned 1 [0042.107] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.116] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0042.116] SetEndOfFile (hFile=0x104) returned 1 [0042.117] CloseHandle (hObject=0x104) returned 1 [0042.117] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.117] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.117] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.117] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.117] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".metadata", cAlternateFileName="METADA~1")) returned 1 [0042.117] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa99567f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99567f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.117] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="idb", cAlternateFileName="")) returned 1 [0042.117] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0042.118] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0042.118] CryptHashData (hHash=0x5c9000, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.118] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9200) returned 1 [0042.118] CryptDestroyHash (hHash=0x5c9000) returned 1 [0042.118] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18e5a0) returned 0 [0042.118] GetLastError () returned 0xea [0042.118] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18e59c*=0x260) returned 1 [0042.118] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0042.119] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0042.120] SetEndOfFile (hFile=0xfc) returned 1 [0042.120] CloseHandle (hObject=0xfc) returned 1 [0042.120] CryptDestroyKey (hKey=0x5c9200) returned 1 [0042.120] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.120] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0042.120] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.120] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb70ff8d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb70ff8d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="818200132aebmoouht", cAlternateFileName="818200~1")) returned 1 [0042.120] CryptAcquireContextA (in: phProv=0x18e32c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e32c*=0x5d0e80) returned 1 [0042.121] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e2e4 | out: phHash=0x18e2e4) returned 1 [0042.121] CryptHashData (hHash=0x5c9000, pbData=0x211c14, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.121] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9000, dwFlags=0x0, phKey=0x18e328 | out: phKey=0x18e328*=0x5c9080) returned 1 [0042.121] CryptDestroyHash (hHash=0x5c9000) returned 1 [0042.121] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18e338*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18e338) returned 0 [0042.121] GetLastError () returned 0xea [0042.121] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18e334*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18e334*=0x260) returned 1 [0042.121] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0042.122] WriteFile (in: hFile=0x100, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e0b8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e0b8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.123] SetEndOfFile (hFile=0x100) returned 1 [0042.123] CloseHandle (hObject=0x100) returned 1 [0042.123] CryptDestroyKey (hKey=0x5c9080) returned 1 [0042.123] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.123] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*.*", lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0042.123] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb70ff8d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.123] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa997c950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.123] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e2d0 | out: lpFindFileData=0x18e2d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa997c950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.123] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0042.124] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb81a92d0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa0000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="818200132aebmoouht.sqlite", cAlternateFileName="818200~1.SQL")) returned 1 [0042.124] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa997c950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.124] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa997c950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.124] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0042.124] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb8110d50, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb8110d50, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="idb", cAlternateFileName="")) returned 0 [0042.124] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.124] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb701b090, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb701b090, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb701b090, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="moz-safe-about+home", cAlternateFileName="MOZ-SA~1")) returned 0 [0042.124] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.124] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4815eb0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4815eb0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x853f60d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="key3.db", cAlternateFileName="")) returned 1 [0042.124] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x850d63f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x850d63f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x850d63f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x501, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="localstore.rdf", cAlternateFileName="LOCALS~1.RDF")) returned 1 [0042.124] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6518ad0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6518ad0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x85572e90, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="marionette.log", cAlternateFileName="MARION~1.LOG")) returned 1 [0042.124] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb50b6e70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb5175550, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb5175550, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xef3, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="mimeTypes.rdf", cAlternateFileName="MIMETY~1.RDF")) returned 1 [0042.124] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b74756f, dwReserved1=0x656d6f68, cFileName="minidumps", cAlternateFileName="MINIDU~1")) returned 1 [0042.124] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0042.125] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0042.125] CryptHashData (hHash=0x5c9100, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.125] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c91c0) returned 1 [0042.125] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.125] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0042.125] GetLastError () returned 0xea [0042.125] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0042.125] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\minidumps\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0042.126] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.126] SetEndOfFile (hFile=0x114) returned 1 [0042.127] CloseHandle (hObject=0x114) returned 1 [0042.127] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.127] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.127] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.127] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa997c950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa997c950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa997c950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa997c950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.127] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80696ec0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="parent.lock", cAlternateFileName="PARENT~1.LOC")) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb43eb830, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb43eb830, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3b3f6e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="permissions.sqlite", cAlternateFileName="PERMIS~1.SQL")) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4c1a3d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb4c1a3d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x82b58970, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa00000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="places.sqlite", cAlternateFileName="PLACES~1.SQL")) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81fbde30, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x81fbde30, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x81fbde30, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="pluginreg.dat", cAlternateFileName="PLUGIN~1.DAT")) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84c85c10, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x853f60d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x12069be0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0xfde, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="prefs.js", cAlternateFileName="")) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6fa8c70, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb6fa8c70, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6fa8c70, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4183, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="search.json", cAlternateFileName="SEARCH~1.JSO")) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb477d930, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb477d930, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb47c9bf0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="secmod.db", cAlternateFileName="")) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc3787480, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3787480, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="sessionstore.bak", cAlternateFileName="SESSIO~1.BAK")) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb82fff30, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x84e029d0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x84e029d0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbc5, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="sessionstore.js", cAlternateFileName="SESSIO~1.JS")) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb6f36850, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x50000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="signons.sqlite", cAlternateFileName="SIGNON~1.SQL")) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb26740e0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb26740e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb26740e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="times.json", cAlternateFileName="TIMES~1.JSO")) returned 1 [0042.127] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x80d71510, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80d71510, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="webapps", cAlternateFileName="")) returned 1 [0042.127] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0042.128] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0042.128] CryptHashData (hHash=0x5c91c0, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.128] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0042.128] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.128] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2178, pdwDataLen=0x18ea70) returned 0 [0042.128] GetLastError () returned 0xea [0042.128] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2178*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0042.130] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0042.131] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.132] SetEndOfFile (hFile=0x114) returned 1 [0042.132] CloseHandle (hObject=0x114) returned 1 [0042.132] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.132] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.132] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa99a2ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99a2ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.132] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb4f60210, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa99a2ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99a2ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.132] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa99a2ab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99a2ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99a2ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80cff0f0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80cff0f0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80cff0f0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="webapps.json", cAlternateFileName="WEBAPP~1.JSO")) returned 0 [0042.133] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3a63b40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x2045526e, dwReserved1=0x52434e45, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb66495d0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb66495d0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xc3a63b40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x2045526e, dwReserved1=0x52434e45, cFileName="webappsstore.sqlite", cAlternateFileName="WEBAPP~1.SQL")) returned 0 [0042.133] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa5533230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5533230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="silmbjec.default", cAlternateFileName="SILMBJ~1.DEF")) returned 0 [0042.133] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5533230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5533230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5533230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x6c756166, dwReserved1=0x52434e74, cFileName="profiles.ini.crypt", cAlternateFileName="PROFIL~1.CRY")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5533230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5533230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5533230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x6c756166, dwReserved1=0x52434e74, cFileName="profiles.ini.crypt", cAlternateFileName="PROFIL~1.CRY")) returned 0 [0042.133] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa990a530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x72632e69, dwReserved1=0x52747079, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa990a530, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa990a530, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa990a530, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x72632e69, dwReserved1=0x52747079, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.133] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xff907610, ftCreationTime.dwHighDateTime=0x1d4d1aa, ftLastAccessTime.dwLowDateTime=0xc235f350, ftLastAccessTime.dwHighDateTime=0x1d4cccb, ftLastWriteTime.dwLowDateTime=0xc235f350, ftLastWriteTime.dwHighDateTime=0x1d4cccb, nFileSizeHigh=0x0, nFileSizeLow=0x12b42, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Ni_8L4qj1FGdbSRxn.doc", cAlternateFileName="NI_8L4~1.DOC")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x762dd060, ftCreationTime.dwHighDateTime=0x1d4cd87, ftLastAccessTime.dwLowDateTime=0xbfc2ec30, ftLastAccessTime.dwHighDateTime=0x1d4c9c5, ftLastWriteTime.dwLowDateTime=0xbfc2ec30, ftLastWriteTime.dwHighDateTime=0x1d4c9c5, nFileSizeHigh=0x0, nFileSizeLow=0xbfb7, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="OqNCxMojZn.wav", cAlternateFileName="OQNCXM~1.WAV")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5559390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5559390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5559390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbad9, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="p1xYK8qxsPAik.png.crypt", cAlternateFileName="P1XYK8~1.CRY")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf68f2650, ftCreationTime.dwHighDateTime=0x1d4d57a, ftLastAccessTime.dwLowDateTime=0xf5244d70, ftLastAccessTime.dwHighDateTime=0x1d4ceb0, ftLastWriteTime.dwLowDateTime=0xf5244d70, ftLastWriteTime.dwHighDateTime=0x1d4ceb0, nFileSizeHigh=0x0, nFileSizeLow=0x97e2, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="pQCAO97rkdmRwj9NW3o3.mp3", cAlternateFileName="PQCAO9~1.MP3")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb38f1600, ftCreationTime.dwHighDateTime=0x1d4d2cb, ftLastAccessTime.dwLowDateTime=0xb9a74170, ftLastAccessTime.dwHighDateTime=0x1d4d38e, ftLastWriteTime.dwLowDateTime=0xb9a74170, ftLastWriteTime.dwHighDateTime=0x1d4d38e, nFileSizeHigh=0x0, nFileSizeLow=0xe073, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="q86puH0YQ-mt7kuzPfbX.mp3", cAlternateFileName="Q86PUH~1.MP3")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x185ab970, ftCreationTime.dwHighDateTime=0x1d4d517, ftLastAccessTime.dwLowDateTime=0xae8211e0, ftLastAccessTime.dwHighDateTime=0x1d4cc8a, ftLastWriteTime.dwLowDateTime=0xae8211e0, ftLastWriteTime.dwHighDateTime=0x1d4cc8a, nFileSizeHigh=0x0, nFileSizeLow=0x1049, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="qeupIUL.bmp", cAlternateFileName="")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64a373d0, ftCreationTime.dwHighDateTime=0x1d4cc84, ftLastAccessTime.dwLowDateTime=0x188b8a80, ftLastAccessTime.dwHighDateTime=0x1d4d203, ftLastWriteTime.dwLowDateTime=0x188b8a80, ftLastWriteTime.dwHighDateTime=0x1d4d203, nFileSizeHigh=0x0, nFileSizeLow=0xbc9b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="qGPw_iyO.mp4", cAlternateFileName="")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1af6d920, ftCreationTime.dwHighDateTime=0x1d4cbf8, ftLastAccessTime.dwLowDateTime=0x6fa24d00, ftLastAccessTime.dwHighDateTime=0x1d4d293, ftLastWriteTime.dwLowDateTime=0x6fa24d00, ftLastWriteTime.dwHighDateTime=0x1d4d293, nFileSizeHigh=0x0, nFileSizeLow=0x9b6c, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="RMAlosi.rtf", cAlternateFileName="")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1f06a80, ftCreationTime.dwHighDateTime=0x1d4c87a, ftLastAccessTime.dwLowDateTime=0xb3d19d80, ftLastAccessTime.dwHighDateTime=0x1d4c868, ftLastWriteTime.dwLowDateTime=0xb3d19d80, ftLastWriteTime.dwHighDateTime=0x1d4c868, nFileSizeHigh=0x0, nFileSizeLow=0x5565, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Tl3qril8wkR9FIs6HZ.swf", cAlternateFileName="TL3QRI~1.SWF")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ed7d440, ftCreationTime.dwHighDateTime=0x1d4c921, ftLastAccessTime.dwLowDateTime=0x5343c2d0, ftLastAccessTime.dwHighDateTime=0x1d4d039, ftLastWriteTime.dwLowDateTime=0x5343c2d0, ftLastWriteTime.dwHighDateTime=0x1d4d039, nFileSizeHigh=0x0, nFileSizeLow=0x64da, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="vzim190EpBWG_TJXvP.m4a", cAlternateFileName="VZIM19~1.M4A")) returned 1 [0042.133] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4818080, ftCreationTime.dwHighDateTime=0x1d4ce92, ftLastAccessTime.dwLowDateTime=0xa784e4c0, ftLastAccessTime.dwHighDateTime=0x1d4d145, ftLastWriteTime.dwLowDateTime=0xa784e4c0, ftLastWriteTime.dwHighDateTime=0x1d4d145, nFileSizeHigh=0x0, nFileSizeLow=0x2165, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Wp7LOk.m4a", cAlternateFileName="")) returned 1 [0042.134] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4c15c810, ftCreationTime.dwHighDateTime=0x1d4c8c7, ftLastAccessTime.dwLowDateTime=0xe9444c20, ftLastAccessTime.dwHighDateTime=0x1d4cb4b, ftLastWriteTime.dwLowDateTime=0xe9444c20, ftLastWriteTime.dwHighDateTime=0x1d4cb4b, nFileSizeHigh=0x0, nFileSizeLow=0x353b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="XJHuolq7G.swf", cAlternateFileName="XJHUOL~1.SWF")) returned 1 [0042.134] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5559390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5559390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa557f4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x12c67, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="XU7TpXHMTpi3hxEYx5.png.crypt", cAlternateFileName="XU7TPX~1.CRY")) returned 1 [0042.134] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5559390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5559390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa557f4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x12c67, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="XU7TpXHMTpi3hxEYx5.png.crypt", cAlternateFileName="XU7TPX~1.CRY")) returned 0 [0042.134] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0042.134] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa557f4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa557f4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Roaming", cAlternateFileName="")) returned 0 [0042.134] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.134] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52434e45, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0042.134] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.134] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.134] CryptHashData (hHash=0x5c8f80, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.134] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c9140) returned 1 [0042.134] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.134] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0720, pdwDataLen=0x18f8e0) returned 0 [0042.135] GetLastError () returned 0xea [0042.135] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0720*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0720*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.135] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.135] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.135] SetEndOfFile (hFile=0xdc) returned 1 [0042.137] CloseHandle (hObject=0xdc) returned 1 [0042.137] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.137] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.137] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x8f\\")) returned 0xffffffff [0042.137] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa557f4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa557f4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="Contacts", cAlternateFileName="")) returned 1 [0042.137] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.138] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.138] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.138] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8f80) returned 1 [0042.138] CryptDestroyHash (hHash=0x5c9140) returned 1 [0042.138] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e22a0*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e22a0, pdwDataLen=0x18f8e0) returned 0 [0042.138] GetLastError () returned 0xea [0042.138] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e22a0*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e22a0*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.138] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.138] WriteFile (in: hFile=0xdc, lpBuffer=0x33e2cb8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33e2cb8*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.139] SetEndOfFile (hFile=0xdc) returned 1 [0042.139] CloseHandle (hObject=0xdc) returned 1 [0042.140] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.140] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.140] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa99a2ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99a2ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.140] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa99a2ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99a2ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.140] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0042.140] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0042.140] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0042.140] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0042.140] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa557f4f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa557f4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa557f4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.140] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99a2ab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99a2ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99a2ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.140] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0042.140] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0042.140] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0042.140] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.140] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Cookies", cAlternateFileName="")) returned 1 [0042.140] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.141] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.141] CryptHashData (hHash=0x5c8f80, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.141] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c9140) returned 1 [0042.141] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.141] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1178*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1178, pdwDataLen=0x18f8e0) returned 0 [0042.141] GetLastError () returned 0xea [0042.141] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1178*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1178*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.141] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\cookies\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.141] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.141] SetEndOfFile (hFile=0xdc) returned 1 [0042.142] CloseHandle (hObject=0xdc) returned 1 [0042.142] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.142] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.142] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x8f\\")) returned 0xffffffff [0042.142] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa55f1910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa55f1910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="Desktop", cAlternateFileName="")) returned 1 [0042.142] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.142] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.142] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.142] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8f80) returned 1 [0042.142] CryptDestroyHash (hHash=0x5c9140) returned 1 [0042.142] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18f8e0) returned 0 [0042.142] GetLastError () returned 0xea [0042.142] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.143] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.143] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.144] SetEndOfFile (hFile=0xdc) returned 1 [0042.145] CloseHandle (hObject=0xdc) returned 1 [0042.145] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.145] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.145] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa99a2ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99a2ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.145] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa99a2ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99a2ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.145] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14160f0, ftCreationTime.dwHighDateTime=0x1d4c777, ftLastAccessTime.dwLowDateTime=0xaac5b9d0, ftLastAccessTime.dwHighDateTime=0x1d4d1f3, ftLastWriteTime.dwLowDateTime=0xaac5b9d0, ftLastWriteTime.dwHighDateTime=0x1d4d1f3, nFileSizeHigh=0x0, nFileSizeLow=0xde72, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="-1ZO0EqDkBVCp64.m4a", cAlternateFileName="-1ZO0E~1.M4A")) returned 1 [0042.145] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa557f4f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa557f4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa55a5650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xd9fa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="20w83dwa.png.crypt", cAlternateFileName="20W83D~1.CRY")) returned 1 [0042.145] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd328fca0, ftCreationTime.dwHighDateTime=0x1d4d2d6, ftLastAccessTime.dwLowDateTime=0x7dfaa9d0, ftLastAccessTime.dwHighDateTime=0x1d4d462, ftLastWriteTime.dwLowDateTime=0x7dfaa9d0, ftLastWriteTime.dwHighDateTime=0x1d4d462, nFileSizeHigh=0x0, nFileSizeLow=0xefb0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="6ze-zapzBvRslmR3.mp3", cAlternateFileName="6ZE-ZA~1.MP3")) returned 1 [0042.145] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20730620, ftCreationTime.dwHighDateTime=0x1d4c7ee, ftLastAccessTime.dwLowDateTime=0x37b67a80, ftLastAccessTime.dwHighDateTime=0x1d4d4b2, ftLastWriteTime.dwLowDateTime=0x37b67a80, ftLastWriteTime.dwHighDateTime=0x1d4d4b2, nFileSizeHigh=0x0, nFileSizeLow=0xa039, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7r-1o.ods", cAlternateFileName="")) returned 1 [0042.145] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdef830, ftCreationTime.dwHighDateTime=0x1d4c7c6, ftLastAccessTime.dwLowDateTime=0x125e680, ftLastAccessTime.dwHighDateTime=0x1d4c810, ftLastWriteTime.dwLowDateTime=0x125e680, ftLastWriteTime.dwHighDateTime=0x1d4c810, nFileSizeHigh=0x0, nFileSizeLow=0xfb6d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="a zSKVxRNzq.gif", cAlternateFileName="AZSKVX~1.GIF")) returned 1 [0042.145] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809b9ec0, ftCreationTime.dwHighDateTime=0x1d4cda4, ftLastAccessTime.dwLowDateTime=0x33a3edc0, ftLastAccessTime.dwHighDateTime=0x1d4c633, ftLastWriteTime.dwLowDateTime=0x33a3edc0, ftLastWriteTime.dwHighDateTime=0x1d4c633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="b ylBYEH0cothr-", cAlternateFileName="BYLBYE~1")) returned 1 [0042.145] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.146] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.146] CryptHashData (hHash=0x5c9140, pbData=0x33e0a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.146] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8fc0) returned 1 [0042.146] CryptDestroyHash (hHash=0x5c9140) returned 1 [0042.146] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07b4*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e07b4, pdwDataLen=0x18f678) returned 0 [0042.146] GetLastError () returned 0xea [0042.146] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07b4*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e07b4*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.146] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b ylbyeh0cothr-\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.146] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.147] SetEndOfFile (hFile=0xf8) returned 1 [0042.147] CloseHandle (hObject=0xf8) returned 1 [0042.147] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.148] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.148] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809b9ec0, ftCreationTime.dwHighDateTime=0x1d4cda4, ftLastAccessTime.dwLowDateTime=0xa99c8c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99c8c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.148] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809b9ec0, ftCreationTime.dwHighDateTime=0x1d4cda4, ftLastAccessTime.dwLowDateTime=0xa99c8c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99c8c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.148] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce6f3f0, ftCreationTime.dwHighDateTime=0x1d4cc46, ftLastAccessTime.dwLowDateTime=0x3a371f70, ftLastAccessTime.dwHighDateTime=0x1d4c810, ftLastWriteTime.dwLowDateTime=0x3a371f70, ftLastWriteTime.dwHighDateTime=0x1d4c810, nFileSizeHigh=0x0, nFileSizeLow=0x13ac2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="A1O_.wav", cAlternateFileName="")) returned 1 [0042.148] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf421e6f0, ftCreationTime.dwHighDateTime=0x1d4c6c0, ftLastAccessTime.dwLowDateTime=0xcd34e4e0, ftLastAccessTime.dwHighDateTime=0x1d4cfab, ftLastWriteTime.dwLowDateTime=0xcd34e4e0, ftLastWriteTime.dwHighDateTime=0x1d4cfab, nFileSizeHigh=0x0, nFileSizeLow=0xc819, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="B320plYDi698XfAex.bmp", cAlternateFileName="B320PL~1.BMP")) returned 1 [0042.148] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9e5bda0, ftCreationTime.dwHighDateTime=0x1d4cd86, ftLastAccessTime.dwLowDateTime=0xbb2edc40, ftLastAccessTime.dwHighDateTime=0x1d4c8a0, ftLastWriteTime.dwLowDateTime=0xbb2edc40, ftLastWriteTime.dwHighDateTime=0x1d4c8a0, nFileSizeHigh=0x0, nFileSizeLow=0x12a52, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="GE7lIEhlHt2sIB.mp3", cAlternateFileName="GE7LIE~1.MP3")) returned 1 [0042.148] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99c8c10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99c8c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99c8c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.148] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2950e170, ftCreationTime.dwHighDateTime=0x1d4c8d6, ftLastAccessTime.dwLowDateTime=0xddf67e10, ftLastAccessTime.dwHighDateTime=0x1d4c7f9, ftLastWriteTime.dwLowDateTime=0xddf67e10, ftLastWriteTime.dwHighDateTime=0x1d4c7f9, nFileSizeHigh=0x0, nFileSizeLow=0x7766, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="JAveQ8Yg3Bf8zCjLZ.flv", cAlternateFileName="JAVEQ8~1.FLV")) returned 1 [0042.148] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddf27250, ftCreationTime.dwHighDateTime=0x1d4d1b0, ftLastAccessTime.dwLowDateTime=0xa55a5650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa55a5650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MuwQtWu1bqcJz_nr_4", cAlternateFileName="MUWQTW~1")) returned 1 [0042.148] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.148] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.149] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.149] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0042.149] CryptDestroyHash (hHash=0x5c9140) returned 1 [0042.149] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1228*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e1228, pdwDataLen=0x18f410) returned 0 [0042.149] GetLastError () returned 0xea [0042.149] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1228*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1228*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.149] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\MuwQtWu1bqcJz_nr_4\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\b ylbyeh0cothr-\\muwqtwu1bqcjz_nr_4\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.150] WriteFile (in: hFile=0xec, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.151] SetEndOfFile (hFile=0xec) returned 1 [0042.151] CloseHandle (hObject=0xec) returned 1 [0042.151] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.151] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.151] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\b ylBYEH0cothr-\\MuwQtWu1bqcJz_nr_4\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddf27250, ftCreationTime.dwHighDateTime=0x1d4d1b0, ftLastAccessTime.dwLowDateTime=0xa99c8c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99c8c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.151] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xddf27250, ftCreationTime.dwHighDateTime=0x1d4d1b0, ftLastAccessTime.dwLowDateTime=0xa99c8c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99c8c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.151] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22397250, ftCreationTime.dwHighDateTime=0x1d4cbe0, ftLastAccessTime.dwLowDateTime=0x7ac25b0, ftLastAccessTime.dwHighDateTime=0x1d4d0d9, ftLastWriteTime.dwLowDateTime=0x7ac25b0, ftLastWriteTime.dwHighDateTime=0x1d4d0d9, nFileSizeHigh=0x0, nFileSizeLow=0xa5f7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="6c5qlTBS.gif", cAlternateFileName="")) returned 1 [0042.151] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0000df0, ftCreationTime.dwHighDateTime=0x1d4c72e, ftLastAccessTime.dwLowDateTime=0x6fb5c480, ftLastAccessTime.dwHighDateTime=0x1d4d210, ftLastWriteTime.dwLowDateTime=0x6fb5c480, ftLastWriteTime.dwHighDateTime=0x1d4d210, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ALdqrxGRhqPLE.flv", cAlternateFileName="ALDQRX~1.FLV")) returned 1 [0042.151] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd99b420, ftCreationTime.dwHighDateTime=0x1d4c53e, ftLastAccessTime.dwLowDateTime=0xe0e4c240, ftLastAccessTime.dwHighDateTime=0x1d4ce79, ftLastWriteTime.dwLowDateTime=0xe0e4c240, ftLastWriteTime.dwHighDateTime=0x1d4ce79, nFileSizeHigh=0x0, nFileSizeLow=0x4032, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AmjLNx2CmR3t6A84g.mp4", cAlternateFileName="AMJLNX~1.MP4")) returned 1 [0042.151] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99c8c10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99c8c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99c8c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.151] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86860ae0, ftCreationTime.dwHighDateTime=0x1d4d4f3, ftLastAccessTime.dwLowDateTime=0xcb546020, ftLastAccessTime.dwHighDateTime=0x1d4c55a, ftLastWriteTime.dwLowDateTime=0xcb546020, ftLastWriteTime.dwHighDateTime=0x1d4c55a, nFileSizeHigh=0x0, nFileSizeLow=0x381d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="lYGVa1V.mp4", cAlternateFileName="")) returned 1 [0042.151] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42cf4370, ftCreationTime.dwHighDateTime=0x1d4c82d, ftLastAccessTime.dwLowDateTime=0x6cd0b80, ftLastAccessTime.dwHighDateTime=0x1d4d135, ftLastWriteTime.dwLowDateTime=0x6cd0b80, ftLastWriteTime.dwHighDateTime=0x1d4d135, nFileSizeHigh=0x0, nFileSizeLow=0x7276, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="rv__7l.pdf", cAlternateFileName="")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15194250, ftCreationTime.dwHighDateTime=0x1d4cd7d, ftLastAccessTime.dwLowDateTime=0x4366a00, ftLastAccessTime.dwHighDateTime=0x1d4d3c5, ftLastWriteTime.dwLowDateTime=0x4366a00, ftLastWriteTime.dwHighDateTime=0x1d4d3c5, nFileSizeHigh=0x0, nFileSizeLow=0x3cc1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="snpq5514f5VxwNHMTa.bmp", cAlternateFileName="SNPQ55~1.BMP")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f67d40, ftCreationTime.dwHighDateTime=0x1d4cbb8, ftLastAccessTime.dwLowDateTime=0x82c09bf0, ftLastAccessTime.dwHighDateTime=0x1d4d165, ftLastWriteTime.dwLowDateTime=0x82c09bf0, ftLastWriteTime.dwHighDateTime=0x1d4d165, nFileSizeHigh=0x0, nFileSizeLow=0x2b4e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="VGGDFIdk-R.gif", cAlternateFileName="VGGDFI~1.GIF")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf59df1e0, ftCreationTime.dwHighDateTime=0x1d4ce0e, ftLastAccessTime.dwLowDateTime=0x8d07a8b0, ftLastAccessTime.dwHighDateTime=0x1d4ce72, ftLastWriteTime.dwLowDateTime=0x8d07a8b0, ftLastWriteTime.dwHighDateTime=0x1d4ce72, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="x5-hMMhjBt-u0xNu.flv", cAlternateFileName="X5-HMM~1.FLV")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55a5650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa55a5650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa55a5650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x106f8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Y8d3EszIaEGJhzPh33x7.png.crypt", cAlternateFileName="Y8D3ES~1.CRY")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55a5650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa55a5650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa55a5650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x106f8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Y8d3EszIaEGJhzPh33x7.png.crypt", cAlternateFileName="Y8D3ES~1.CRY")) returned 0 [0042.152] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49b5a0, ftCreationTime.dwHighDateTime=0x1d4c753, ftLastAccessTime.dwLowDateTime=0x6b8631f0, ftLastAccessTime.dwHighDateTime=0x1d4c807, ftLastWriteTime.dwLowDateTime=0x6b8631f0, ftLastWriteTime.dwHighDateTime=0x1d4c807, nFileSizeHigh=0x0, nFileSizeLow=0x13fd6, dwReserved0=0x507a684a, dwReserved1=0x78333368, cFileName="nVlL.pdf", cAlternateFileName="")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63123030, ftCreationTime.dwHighDateTime=0x1d4d18c, ftLastAccessTime.dwLowDateTime=0x34f83ab0, ftLastAccessTime.dwHighDateTime=0x1d4cda8, ftLastWriteTime.dwLowDateTime=0x34f83ab0, ftLastWriteTime.dwHighDateTime=0x1d4cda8, nFileSizeHigh=0x0, nFileSizeLow=0xe841, dwReserved0=0x507a684a, dwReserved1=0x78333368, cFileName="oE_MoJA.bmp", cAlternateFileName="")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b673c10, ftCreationTime.dwHighDateTime=0x1d4ce46, ftLastAccessTime.dwLowDateTime=0x2a8a70f0, ftLastAccessTime.dwHighDateTime=0x1d4cd0a, ftLastWriteTime.dwLowDateTime=0x2a8a70f0, ftLastWriteTime.dwHighDateTime=0x1d4cd0a, nFileSizeHigh=0x0, nFileSizeLow=0x33e8, dwReserved0=0x507a684a, dwReserved1=0x78333368, cFileName="yPs6sZU6g.gif", cAlternateFileName="YPS6SZ~1.GIF")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b673c10, ftCreationTime.dwHighDateTime=0x1d4ce46, ftLastAccessTime.dwLowDateTime=0x2a8a70f0, ftLastAccessTime.dwHighDateTime=0x1d4cd0a, ftLastWriteTime.dwLowDateTime=0x2a8a70f0, ftLastWriteTime.dwHighDateTime=0x1d4cd0a, nFileSizeHigh=0x0, nFileSizeLow=0x33e8, dwReserved0=0x507a684a, dwReserved1=0x78333368, cFileName="yPs6sZU6g.gif", cAlternateFileName="YPS6SZ~1.GIF")) returned 0 [0042.152] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f59090, ftCreationTime.dwHighDateTime=0x1d4ce3e, ftLastAccessTime.dwLowDateTime=0xde842f60, ftLastAccessTime.dwHighDateTime=0x1d4d43f, ftLastWriteTime.dwLowDateTime=0xde842f60, ftLastWriteTime.dwHighDateTime=0x1d4d43f, nFileSizeHigh=0x0, nFileSizeLow=0x23fd, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="cMtYEfpdkz.avi", cAlternateFileName="CMTYEF~1.AVI")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87179000, ftCreationTime.dwHighDateTime=0x1d4c80f, ftLastAccessTime.dwLowDateTime=0x647a9dc0, ftLastAccessTime.dwHighDateTime=0x1d4c5ef, ftLastWriteTime.dwLowDateTime=0x647a9dc0, ftLastWriteTime.dwHighDateTime=0x1d4c5ef, nFileSizeHigh=0x0, nFileSizeLow=0x51f1, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="cSpgQsUvdWcqqW_4G8m.xls", cAlternateFileName="CSPGQS~1.XLS")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55a5650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa55a5650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa55cb7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdea96a0, ftCreationTime.dwHighDateTime=0x1d4ce8f, ftLastAccessTime.dwLowDateTime=0xe5f45b10, ftLastAccessTime.dwHighDateTime=0x1d4c5eb, ftLastWriteTime.dwLowDateTime=0xe5f45b10, ftLastWriteTime.dwHighDateTime=0x1d4c5eb, nFileSizeHigh=0x0, nFileSizeLow=0x6d6f, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="E7OPP_CKfRC.mp3", cAlternateFileName="E7OPP_~1.MP3")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd2644f0, ftCreationTime.dwHighDateTime=0x1d4cea5, ftLastAccessTime.dwLowDateTime=0xa9f2b2f0, ftLastAccessTime.dwHighDateTime=0x1d4d262, ftLastWriteTime.dwLowDateTime=0xa9f2b2f0, ftLastWriteTime.dwHighDateTime=0x1d4d262, nFileSizeHigh=0x0, nFileSizeLow=0xdad7, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="et hDjezCTkvEK.pdf", cAlternateFileName="ETHDJE~1.PDF")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55cb7b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa55cb7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa55cb7b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x14a5d, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="gjcKm.png.crypt", cAlternateFileName="GJCKMP~1.CRY")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99a2ab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99a2ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99c8c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46e1a20, ftCreationTime.dwHighDateTime=0x1d4cf43, ftLastAccessTime.dwLowDateTime=0x9471ce20, ftLastAccessTime.dwHighDateTime=0x1d4cfba, ftLastWriteTime.dwLowDateTime=0x9471ce20, ftLastWriteTime.dwHighDateTime=0x1d4cfba, nFileSizeHigh=0x0, nFileSizeLow=0xd8b9, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="IJ5_x.flv", cAlternateFileName="")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c11ed0, ftCreationTime.dwHighDateTime=0x1d4ce96, ftLastAccessTime.dwLowDateTime=0x74a328a0, ftLastAccessTime.dwHighDateTime=0x1d4c86c, ftLastWriteTime.dwLowDateTime=0x74a328a0, ftLastWriteTime.dwHighDateTime=0x1d4c86c, nFileSizeHigh=0x0, nFileSizeLow=0xef16, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="jG3vzNQGM1CtOvm6pf.m4a", cAlternateFileName="JG3VZN~1.M4A")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9b8340, ftCreationTime.dwHighDateTime=0x1d4d3d9, ftLastAccessTime.dwLowDateTime=0xe2787610, ftLastAccessTime.dwHighDateTime=0x1d4d0f4, ftLastWriteTime.dwLowDateTime=0xe2787610, ftLastWriteTime.dwHighDateTime=0x1d4d0f4, nFileSizeHigh=0x0, nFileSizeLow=0x6219, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="jzvXZWBC2RYZP.odt", cAlternateFileName="JZVXZW~1.ODT")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3529d0, ftCreationTime.dwHighDateTime=0x1d4d3ba, ftLastAccessTime.dwLowDateTime=0xc1f3e5c0, ftLastAccessTime.dwHighDateTime=0x1d4cb61, ftLastWriteTime.dwLowDateTime=0xc1f3e5c0, ftLastWriteTime.dwHighDateTime=0x1d4cb61, nFileSizeHigh=0x0, nFileSizeLow=0x1699b, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="L32hcyZtEpundH.gif", cAlternateFileName="L32HCY~1.GIF")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90df9e50, ftCreationTime.dwHighDateTime=0x1d4d239, ftLastAccessTime.dwLowDateTime=0x82d82370, ftLastAccessTime.dwHighDateTime=0x1d4cdb3, ftLastWriteTime.dwLowDateTime=0x82d82370, ftLastWriteTime.dwHighDateTime=0x1d4cdb3, nFileSizeHigh=0x0, nFileSizeLow=0x55a7, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="m1sLm.odp", cAlternateFileName="")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed900170, ftCreationTime.dwHighDateTime=0x1d4cf2e, ftLastAccessTime.dwLowDateTime=0x8a887570, ftLastAccessTime.dwHighDateTime=0x1d4d173, ftLastWriteTime.dwLowDateTime=0x8a887570, ftLastWriteTime.dwHighDateTime=0x1d4d173, nFileSizeHigh=0x0, nFileSizeLow=0x3366, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="MhBfTwQVfw35OGKm.m4a", cAlternateFileName="MHBFTW~1.M4A")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f68220, ftCreationTime.dwHighDateTime=0x1d4c914, ftLastAccessTime.dwLowDateTime=0xd0c8e730, ftLastAccessTime.dwHighDateTime=0x1d4d052, ftLastWriteTime.dwLowDateTime=0xd0c8e730, ftLastWriteTime.dwHighDateTime=0x1d4d052, nFileSizeHigh=0x0, nFileSizeLow=0x4d0f, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="moa2K41f.rtf", cAlternateFileName="")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55cb7b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa55cb7b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa55f1910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8f45, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="ormD1bwYTJ2PVU.png.crypt", cAlternateFileName="ORMD1B~1.CRY")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9104fc00, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x9104fc00, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x8fd3cf00, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xfc00, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="search1.exe", cAlternateFileName="")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d62d20, ftCreationTime.dwHighDateTime=0x1d4d08e, ftLastAccessTime.dwLowDateTime=0xc0d00d90, ftLastAccessTime.dwHighDateTime=0x1d4d4d5, ftLastWriteTime.dwLowDateTime=0xc0d00d90, ftLastWriteTime.dwHighDateTime=0x1d4d4d5, nFileSizeHigh=0x0, nFileSizeLow=0x37a9, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="SYrO3Uqr5m.doc", cAlternateFileName="SYRO3U~1.DOC")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1526fe10, ftCreationTime.dwHighDateTime=0x1d4ce66, ftLastAccessTime.dwLowDateTime=0x3dc6e80, ftLastAccessTime.dwHighDateTime=0x1d4d125, ftLastWriteTime.dwLowDateTime=0x3dc6e80, ftLastWriteTime.dwHighDateTime=0x1d4d125, nFileSizeHigh=0x0, nFileSizeLow=0x12dd, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="VyfcFK-R3a9.bmp", cAlternateFileName="VYFCFK~1.BMP")) returned 1 [0042.152] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x884dbca0, ftCreationTime.dwHighDateTime=0x1d4c67b, ftLastAccessTime.dwLowDateTime=0xec5f7db0, ftLastAccessTime.dwHighDateTime=0x1d4d110, ftLastWriteTime.dwLowDateTime=0xec5f7db0, ftLastWriteTime.dwHighDateTime=0x1d4d110, nFileSizeHigh=0x0, nFileSizeLow=0x3592, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="WAi1jwpO1En.mp3", cAlternateFileName="WAI1JW~1.MP3")) returned 1 [0042.153] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31f8b220, ftCreationTime.dwHighDateTime=0x1d4d020, ftLastAccessTime.dwLowDateTime=0xd86efa00, ftLastAccessTime.dwHighDateTime=0x1d4d1e3, ftLastWriteTime.dwLowDateTime=0xd86efa00, ftLastWriteTime.dwHighDateTime=0x1d4d1e3, nFileSizeHigh=0x0, nFileSizeLow=0x15d5a, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="xcOG-kT40w_1.mp3", cAlternateFileName="XCOG-K~1.MP3")) returned 1 [0042.153] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46370560, ftCreationTime.dwHighDateTime=0x1d4ce55, ftLastAccessTime.dwLowDateTime=0x709040e0, ftLastAccessTime.dwHighDateTime=0x1d4d3cf, ftLastWriteTime.dwLowDateTime=0x709040e0, ftLastWriteTime.dwHighDateTime=0x1d4d3cf, nFileSizeHigh=0x0, nFileSizeLow=0x76b5, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="yi5Fra9ft4.mp4", cAlternateFileName="YI5FRA~1.MP4")) returned 1 [0042.153] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c72b0a0, ftCreationTime.dwHighDateTime=0x1d4d3a7, ftLastAccessTime.dwLowDateTime=0xd07990c0, ftLastAccessTime.dwHighDateTime=0x1d4c825, ftLastWriteTime.dwLowDateTime=0xd07990c0, ftLastWriteTime.dwHighDateTime=0x1d4c825, nFileSizeHigh=0x0, nFileSizeLow=0xa36, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="ZEoBqRXpotPIws.flv", cAlternateFileName="ZEOBQR~1.FLV")) returned 1 [0042.153] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa2c39b0, ftCreationTime.dwHighDateTime=0x1d4ce68, ftLastAccessTime.dwLowDateTime=0x7256ac20, ftLastAccessTime.dwHighDateTime=0x1d4cd44, ftLastWriteTime.dwLowDateTime=0x7256ac20, ftLastWriteTime.dwHighDateTime=0x1d4cd44, nFileSizeHigh=0x0, nFileSizeLow=0x1877f, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="zl843XUZ-N90kI2vZ3.avi", cAlternateFileName="ZL843X~1.AVI")) returned 1 [0042.153] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe65a16f0, ftCreationTime.dwHighDateTime=0x1d4d04d, ftLastAccessTime.dwLowDateTime=0x2092b230, ftLastAccessTime.dwHighDateTime=0x1d4cf38, ftLastWriteTime.dwLowDateTime=0x2092b230, ftLastWriteTime.dwHighDateTime=0x1d4cf38, nFileSizeHigh=0x0, nFileSizeLow=0x4735, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="ZsjQKdPOBo.swf", cAlternateFileName="ZSJQKD~1.SWF")) returned 1 [0042.153] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2bbd10, ftCreationTime.dwHighDateTime=0x1d4cdab, ftLastAccessTime.dwLowDateTime=0x525219d0, ftLastAccessTime.dwHighDateTime=0x1d4cd5a, ftLastWriteTime.dwLowDateTime=0x525219d0, ftLastWriteTime.dwHighDateTime=0x1d4cd5a, nFileSizeHigh=0x0, nFileSizeLow=0x11698, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="_HZMpmSMDeXQp.wav", cAlternateFileName="_HZMPM~1.WAV")) returned 1 [0042.153] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe06dcef0, ftCreationTime.dwHighDateTime=0x1d4cfb5, ftLastAccessTime.dwLowDateTime=0xaa9d9d20, ftLastAccessTime.dwHighDateTime=0x1d4cb08, ftLastWriteTime.dwLowDateTime=0xaa9d9d20, ftLastWriteTime.dwHighDateTime=0x1d4cb08, nFileSizeHigh=0x0, nFileSizeLow=0x11d47, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="_zV ld0rkKX1LQg7da.csv", cAlternateFileName="_ZVLD0~1.CSV")) returned 1 [0042.153] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe06dcef0, ftCreationTime.dwHighDateTime=0x1d4cfb5, ftLastAccessTime.dwLowDateTime=0xaa9d9d20, ftLastAccessTime.dwHighDateTime=0x1d4cb08, ftLastWriteTime.dwLowDateTime=0xaa9d9d20, ftLastWriteTime.dwHighDateTime=0x1d4cb08, nFileSizeHigh=0x0, nFileSizeLow=0x11d47, dwReserved0=0x6e5f6669, dwReserved1=0x66345f72, cFileName="_zV ld0rkKX1LQg7da.csv", cAlternateFileName="_ZVLD0~1.CSV")) returned 0 [0042.153] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.153] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa55f1910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa55f1910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67514c31, dwReserved1=0x2e616437, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0042.153] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.154] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.154] CryptHashData (hHash=0x5c8f80, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.154] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8fc0) returned 1 [0042.154] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.154] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2d38*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2d38, pdwDataLen=0x18f8e0) returned 0 [0042.154] GetLastError () returned 0xea [0042.154] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2d38*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2d38*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.154] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.154] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.155] SetEndOfFile (hFile=0xdc) returned 1 [0042.155] CloseHandle (hObject=0xdc) returned 1 [0042.155] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.155] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.156] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa99c8c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99c8c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa99c8c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99c8c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e1c0b0, ftCreationTime.dwHighDateTime=0x1d4d4be, ftLastAccessTime.dwLowDateTime=0xe5afd50, ftLastAccessTime.dwHighDateTime=0x1d4d214, ftLastWriteTime.dwLowDateTime=0xe5afd50, ftLastWriteTime.dwHighDateTime=0x1d4d214, nFileSizeHigh=0x0, nFileSizeLow=0x613c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1lgdOtiNG.csv", cAlternateFileName="1LGDOT~1.CSV")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42292cb0, ftCreationTime.dwHighDateTime=0x1d4cfb2, ftLastAccessTime.dwLowDateTime=0x8f64d240, ftLastAccessTime.dwHighDateTime=0x1d4cd64, ftLastWriteTime.dwLowDateTime=0x8f64d240, ftLastWriteTime.dwHighDateTime=0x1d4cd64, nFileSizeHigh=0x0, nFileSizeLow=0x197d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="2-v8OsluyXo6NQ.pps", cAlternateFileName="2-V8OS~1.PPS")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeaa4fa0, ftCreationTime.dwHighDateTime=0x1d51af9, ftLastAccessTime.dwLowDateTime=0x2be1f30, ftLastAccessTime.dwHighDateTime=0x1d4f993, ftLastWriteTime.dwLowDateTime=0x2be1f30, ftLastWriteTime.dwHighDateTime=0x1d4f993, nFileSizeHigh=0x0, nFileSizeLow=0x3ccf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="2Qy9fNpQyCJ 70GH9.xlsx", cAlternateFileName="2QY9FN~1.XLS")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf96574f0, ftCreationTime.dwHighDateTime=0x1d4c7de, ftLastAccessTime.dwLowDateTime=0x83cceb30, ftLastAccessTime.dwHighDateTime=0x1d4d37b, ftLastWriteTime.dwLowDateTime=0x83cceb30, ftLastWriteTime.dwHighDateTime=0x1d4d37b, nFileSizeHigh=0x0, nFileSizeLow=0x2c59, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="3bgp1RW3KcVuB5mMAG.doc", cAlternateFileName="3BGP1R~1.DOC")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa827be80, ftCreationTime.dwHighDateTime=0x1d531bb, ftLastAccessTime.dwLowDateTime=0x369ea470, ftLastAccessTime.dwHighDateTime=0x1d5259c, ftLastWriteTime.dwLowDateTime=0x369ea470, ftLastWriteTime.dwHighDateTime=0x1d5259c, nFileSizeHigh=0x0, nFileSizeLow=0x1196a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7H_dTpHa.xlsx", cAlternateFileName="7H_DTP~1.XLS")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd6030, ftCreationTime.dwHighDateTime=0x1d4cb87, ftLastAccessTime.dwLowDateTime=0x5e46d7f0, ftLastAccessTime.dwHighDateTime=0x1d4c835, ftLastWriteTime.dwLowDateTime=0x5e46d7f0, ftLastWriteTime.dwHighDateTime=0x1d4c835, nFileSizeHigh=0x0, nFileSizeLow=0x46f7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ACyV4Fg44jp6azL.ods", cAlternateFileName="ACYV4F~1.ODS")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27386290, ftCreationTime.dwHighDateTime=0x1d4d1a6, ftLastAccessTime.dwLowDateTime=0x7e81dba0, ftLastAccessTime.dwHighDateTime=0x1d4c7b3, ftLastWriteTime.dwLowDateTime=0x7e81dba0, ftLastWriteTime.dwHighDateTime=0x1d4c7b3, nFileSizeHigh=0x0, nFileSizeLow=0xfeba, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="aIhTDD.xls", cAlternateFileName="")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4b4ac60, ftCreationTime.dwHighDateTime=0x1d4e970, ftLastAccessTime.dwLowDateTime=0x47eb7720, ftLastAccessTime.dwHighDateTime=0x1d4c689, ftLastWriteTime.dwLowDateTime=0x47eb7720, ftLastWriteTime.dwHighDateTime=0x1d4c689, nFileSizeHigh=0x0, nFileSizeLow=0x1503a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BEOeKw eDuhD3.docx", cAlternateFileName="BEOEKW~1.DOC")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x695fdc0, ftCreationTime.dwHighDateTime=0x1d4cbd6, ftLastAccessTime.dwLowDateTime=0x7f4fa3f0, ftLastAccessTime.dwHighDateTime=0x1d4c858, ftLastWriteTime.dwLowDateTime=0x7f4fa3f0, ftLastWriteTime.dwHighDateTime=0x1d4c858, nFileSizeHigh=0x0, nFileSizeLow=0xd967, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ck22L.rtf", cAlternateFileName="")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc26e2a0, ftCreationTime.dwHighDateTime=0x1d4d3ea, ftLastAccessTime.dwLowDateTime=0x540dbb30, ftLastAccessTime.dwHighDateTime=0x1d4d56b, ftLastWriteTime.dwLowDateTime=0x540dbb30, ftLastWriteTime.dwHighDateTime=0x1d4d56b, nFileSizeHigh=0x0, nFileSizeLow=0xbcdb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ctgIJ7lZLN2CGput Xl.ots", cAlternateFileName="CTGIJ7~1.OTS")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55f1910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa55f1910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa55f1910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd901a70, ftCreationTime.dwHighDateTime=0x1d4d03e, ftLastAccessTime.dwLowDateTime=0xa9aed5c0, ftLastAccessTime.dwHighDateTime=0x1d4ea14, ftLastWriteTime.dwLowDateTime=0xa9aed5c0, ftLastWriteTime.dwHighDateTime=0x1d4ea14, nFileSizeHigh=0x0, nFileSizeLow=0xf1b6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="DXvVoXwv.pptx", cAlternateFileName="DXVVOX~1.PPT")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b203130, ftCreationTime.dwHighDateTime=0x1d4cfb6, ftLastAccessTime.dwLowDateTime=0xbd12d5f0, ftLastAccessTime.dwHighDateTime=0x1d4ef99, ftLastWriteTime.dwLowDateTime=0xbd12d5f0, ftLastWriteTime.dwHighDateTime=0x1d4ef99, nFileSizeHigh=0x0, nFileSizeLow=0x14c2c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fgkJ1j.pptx", cAlternateFileName="FGKJ1J~1.PPT")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229c6050, ftCreationTime.dwHighDateTime=0x1d4ca13, ftLastAccessTime.dwLowDateTime=0x9a531b50, ftLastAccessTime.dwHighDateTime=0x1d4d19f, ftLastWriteTime.dwLowDateTime=0x9a531b50, ftLastWriteTime.dwHighDateTime=0x1d4d19f, nFileSizeHigh=0x0, nFileSizeLow=0x1019e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Gepf8q naWWdA3Hh.odt", cAlternateFileName="GEPF8Q~1.ODT")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee697180, ftCreationTime.dwHighDateTime=0x1d4ca4c, ftLastAccessTime.dwLowDateTime=0xb5f70a50, ftLastAccessTime.dwHighDateTime=0x1d4c70f, ftLastWriteTime.dwLowDateTime=0xb5f70a50, ftLastWriteTime.dwHighDateTime=0x1d4c70f, nFileSizeHigh=0x0, nFileSizeLow=0xce4a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="gOVPRFjodhzZVtG.doc", cAlternateFileName="GOVPRF~1.DOC")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83cfc70, ftCreationTime.dwHighDateTime=0x1d4fbd1, ftLastAccessTime.dwLowDateTime=0x490be870, ftLastAccessTime.dwHighDateTime=0x1d52074, ftLastWriteTime.dwLowDateTime=0x490be870, ftLastWriteTime.dwHighDateTime=0x1d52074, nFileSizeHigh=0x0, nFileSizeLow=0x14780, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="gWma.pptx", cAlternateFileName="GWMA~1.PPT")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99c8c10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99c8c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99c8c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f35e530, ftCreationTime.dwHighDateTime=0x1d4c597, ftLastAccessTime.dwLowDateTime=0xf7fe5270, ftLastAccessTime.dwHighDateTime=0x1d4ce42, ftLastWriteTime.dwLowDateTime=0xf7fe5270, ftLastWriteTime.dwHighDateTime=0x1d4ce42, nFileSizeHigh=0x0, nFileSizeLow=0xbb91, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="I8sW8qFtvHq_OBx.odp", cAlternateFileName="I8SW8Q~1.ODP")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70eb8360, ftCreationTime.dwHighDateTime=0x1d4c5f1, ftLastAccessTime.dwLowDateTime=0x46dc7210, ftLastAccessTime.dwHighDateTime=0x1d4ca00, ftLastWriteTime.dwLowDateTime=0x46dc7210, ftLastWriteTime.dwHighDateTime=0x1d4ca00, nFileSizeHigh=0x0, nFileSizeLow=0x185ac, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ixcTUA2MdhOdrM8T-je.pps", cAlternateFileName="IXCTUA~1.PPS")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b4284b0, ftCreationTime.dwHighDateTime=0x1d4c540, ftLastAccessTime.dwLowDateTime=0x2e76ac60, ftLastAccessTime.dwHighDateTime=0x1d4c611, ftLastWriteTime.dwLowDateTime=0x2e76ac60, ftLastWriteTime.dwHighDateTime=0x1d4c611, nFileSizeHigh=0x0, nFileSizeLow=0x11d05, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="jFlm5M5isN1V6QsQFljh.doc", cAlternateFileName="JFLM5M~1.DOC")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ee71a0, ftCreationTime.dwHighDateTime=0x1d4ca7a, ftLastAccessTime.dwLowDateTime=0xf2162ee0, ftLastAccessTime.dwHighDateTime=0x1d5014c, ftLastWriteTime.dwLowDateTime=0xf2162ee0, ftLastWriteTime.dwHighDateTime=0x1d5014c, nFileSizeHigh=0x0, nFileSizeLow=0x6e16, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LcEzmMI.xlsx", cAlternateFileName="LCEZMM~1.XLS")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96c032a0, ftCreationTime.dwHighDateTime=0x1d4cbe3, ftLastAccessTime.dwLowDateTime=0x89a92780, ftLastAccessTime.dwHighDateTime=0x1d4c9a8, ftLastWriteTime.dwLowDateTime=0x89a92780, ftLastWriteTime.dwHighDateTime=0x1d4c9a8, nFileSizeHigh=0x0, nFileSizeLow=0x12c66, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LmtSVhfzw.ppt", cAlternateFileName="LMTSVH~1.PPT")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x649fb4e0, ftCreationTime.dwHighDateTime=0x1d4c692, ftLastAccessTime.dwLowDateTime=0x9ecb7490, ftLastAccessTime.dwHighDateTime=0x1d4c74d, ftLastWriteTime.dwLowDateTime=0x9ecb7490, ftLastWriteTime.dwHighDateTime=0x1d4c74d, nFileSizeHigh=0x0, nFileSizeLow=0x17dad, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="lovM7zTe54ZDP.pdf", cAlternateFileName="LOVM7Z~1.PDF")) returned 1 [0042.156] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x5a0000, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0042.156] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.157] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.157] CryptHashData (hHash=0x5c8f80, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.157] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.157] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.157] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15d0*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e15d0, pdwDataLen=0x18f678) returned 0 [0042.157] GetLastError () returned 0xea [0042.157] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e15d0*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e15d0*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.158] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my music\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.158] WriteFile (in: hFile=0xf8, lpBuffer=0x33e26c0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33e26c0*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.159] SetEndOfFile (hFile=0xf8) returned 1 [0042.159] CloseHandle (hObject=0xf8) returned 1 [0042.159] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.159] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.159] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f60c, ftLastWriteTime.dwHighDateTime=0x18f608, nFileSizeHigh=0x18f650, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x8f\x5c")) returned 0xffffffff [0042.159] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x183, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0042.159] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.160] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.160] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.160] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f80) returned 1 [0042.160] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.160] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2720*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2720, pdwDataLen=0x18f678) returned 0 [0042.160] GetLastError () returned 0xea [0042.160] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2720*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2720*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.161] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my pictures\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.161] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.162] SetEndOfFile (hFile=0xf8) returned 1 [0042.162] CloseHandle (hObject=0xf8) returned 1 [0042.162] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.162] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.162] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f60c, ftLastWriteTime.dwHighDateTime=0x18f608, nFileSizeHigh=0x18f650, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x8f\x5c")) returned 0xffffffff [0042.162] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xa5617a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5617a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0042.162] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.163] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.163] CryptHashData (hHash=0x5c8f80, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.163] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.163] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.163] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18f678) returned 0 [0042.163] GetLastError () returned 0xea [0042.163] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.163] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.164] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.165] SetEndOfFile (hFile=0xf8) returned 1 [0042.165] CloseHandle (hObject=0xf8) returned 1 [0042.165] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.165] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.165] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99eed70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.165] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99eed70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.165] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5617a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5617a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5617a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.165] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0042.165] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99eed70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99eed70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.165] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_private", cAlternateFileName="")) returned 1 [0042.165] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.166] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.166] CryptHashData (hHash=0x5c8f80, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.166] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9140) returned 1 [0042.166] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.166] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18f410) returned 0 [0042.166] GetLastError () returned 0xea [0042.166] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.166] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.167] WriteFile (in: hFile=0xec, lpBuffer=0x33e18d4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33e18d4*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.167] SetEndOfFile (hFile=0xec) returned 1 [0042.167] CloseHandle (hObject=0xec) returned 1 [0042.170] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.170] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.170] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99eed70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0042.170] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99eed70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.170] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0042.170] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99eed70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99eed70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.170] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99eed70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99eed70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.170] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0042.170] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="_private", cAlternateFileName="")) returned 0 [0042.170] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.170] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52434e45, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0042.170] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.171] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.171] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.171] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9140) returned 1 [0042.171] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.171] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f24*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2f24, pdwDataLen=0x18f678) returned 0 [0042.171] GetLastError () returned 0xea [0042.171] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f24*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2f24*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.171] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my videos\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.172] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.172] SetEndOfFile (hFile=0xf8) returned 1 [0042.172] CloseHandle (hObject=0xf8) returned 1 [0042.173] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.173] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.173] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f60c, ftLastWriteTime.dwHighDateTime=0x18f608, nFileSizeHigh=0x18f650, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x8f\x5c")) returned 0xffffffff [0042.173] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10a20420, ftCreationTime.dwHighDateTime=0x1d4cfc4, ftLastAccessTime.dwLowDateTime=0x77c61c90, ftLastAccessTime.dwHighDateTime=0x1d4d37a, ftLastWriteTime.dwLowDateTime=0x77c61c90, ftLastWriteTime.dwHighDateTime=0x1d4d37a, nFileSizeHigh=0x0, nFileSizeLow=0xad6c, dwReserved0=0x3, dwReserved1=0x183, cFileName="nI67Wp8LP7.ppt", cAlternateFileName="NI67WP~1.PPT")) returned 1 [0042.173] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10a03f90, ftCreationTime.dwHighDateTime=0x1d4c575, ftLastAccessTime.dwLowDateTime=0xcddb17b0, ftLastAccessTime.dwHighDateTime=0x1d4d4d4, ftLastWriteTime.dwLowDateTime=0xcddb17b0, ftLastWriteTime.dwHighDateTime=0x1d4d4d4, nFileSizeHigh=0x0, nFileSizeLow=0x5e46, dwReserved0=0x3, dwReserved1=0x183, cFileName="nJaxoH3z6.pptx", cAlternateFileName="NJAXOH~1.PPT")) returned 1 [0042.173] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe573e000, ftCreationTime.dwHighDateTime=0x1d4c8d6, ftLastAccessTime.dwLowDateTime=0x62273d50, ftLastAccessTime.dwHighDateTime=0x1d4d3e4, ftLastWriteTime.dwLowDateTime=0x62273d50, ftLastWriteTime.dwHighDateTime=0x1d4d3e4, nFileSizeHigh=0x0, nFileSizeLow=0x9ea1, dwReserved0=0x3, dwReserved1=0x183, cFileName="nL2dk-97jFEcTR.docx", cAlternateFileName="NL2DK-~1.DOC")) returned 1 [0042.173] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x539b0a20, ftCreationTime.dwHighDateTime=0x1d4c960, ftLastAccessTime.dwLowDateTime=0x51890980, ftLastAccessTime.dwHighDateTime=0x1d4d365, ftLastWriteTime.dwLowDateTime=0x51890980, ftLastWriteTime.dwHighDateTime=0x1d4d365, nFileSizeHigh=0x0, nFileSizeLow=0xea22, dwReserved0=0x3, dwReserved1=0x183, cFileName="NPyBn4PYfD0Uer9-.pdf", cAlternateFileName="NPYBN4~1.PDF")) returned 1 [0042.173] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0042.173] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.174] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.174] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.174] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.174] CryptDestroyHash (hHash=0x5c9140) returned 1 [0042.174] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2ef4*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2ef4, pdwDataLen=0x18f678) returned 0 [0042.174] GetLastError () returned 0xea [0042.174] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2ef4*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2ef4*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.174] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.175] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.176] SetEndOfFile (hFile=0xf8) returned 1 [0042.176] CloseHandle (hObject=0xf8) returned 1 [0042.176] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.176] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.176] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99eed70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.177] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99eed70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99eed70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0042.177] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebcbbd0, ftCreationTime.dwHighDateTime=0x1d525cc, ftLastAccessTime.dwLowDateTime=0x66bda870, ftLastAccessTime.dwHighDateTime=0x1d4cecd, ftLastWriteTime.dwLowDateTime=0x66bda870, ftLastWriteTime.dwHighDateTime=0x1d4cecd, nFileSizeHigh=0x0, nFileSizeLow=0xa97a, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="PnJy.docx", cAlternateFileName="PNJY~1.DOC")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3aa31860, ftCreationTime.dwHighDateTime=0x1d4c7a7, ftLastAccessTime.dwLowDateTime=0x1bca7800, ftLastAccessTime.dwHighDateTime=0x1d4d3a7, ftLastWriteTime.dwLowDateTime=0x1bca7800, ftLastWriteTime.dwHighDateTime=0x1d4d3a7, nFileSizeHigh=0x0, nFileSizeLow=0xe17c, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="QWKwKdI.pps", cAlternateFileName="")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73828380, ftCreationTime.dwHighDateTime=0x1d4d019, ftLastAccessTime.dwLowDateTime=0x64f26400, ftLastAccessTime.dwHighDateTime=0x1d4d25f, ftLastWriteTime.dwLowDateTime=0x64f26400, ftLastWriteTime.dwHighDateTime=0x1d4d25f, nFileSizeHigh=0x0, nFileSizeLow=0x401c, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="RJTkAx3XvY.ods", cAlternateFileName="RJTKAX~1.ODS")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a9cea0, ftCreationTime.dwHighDateTime=0x1d4d5a2, ftLastAccessTime.dwLowDateTime=0x5806bc70, ftLastAccessTime.dwHighDateTime=0x1d4cf65, ftLastWriteTime.dwLowDateTime=0x5806bc70, ftLastWriteTime.dwHighDateTime=0x1d4cf65, nFileSizeHigh=0x0, nFileSizeLow=0xe343, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="RsbC_5Xwws.docx", cAlternateFileName="RSBC_5~1.DOC")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0d287c0, ftCreationTime.dwHighDateTime=0x1d4d1d8, ftLastAccessTime.dwLowDateTime=0xe2ae2b30, ftLastAccessTime.dwHighDateTime=0x1d4ca95, ftLastWriteTime.dwLowDateTime=0xe2ae2b30, ftLastWriteTime.dwHighDateTime=0x1d4ca95, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="RTNc lp7dm74RUn.xls", cAlternateFileName="RTNCLP~1.XLS")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8c72f0, ftCreationTime.dwHighDateTime=0x1d4caaf, ftLastAccessTime.dwLowDateTime=0xd1446090, ftLastAccessTime.dwHighDateTime=0x1d4d4b7, ftLastWriteTime.dwLowDateTime=0xd1446090, ftLastWriteTime.dwHighDateTime=0x1d4d4b7, nFileSizeHigh=0x0, nFileSizeLow=0x189df, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="svF1qlhEpB-.ots", cAlternateFileName="SVF1QL~1.OTS")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e2bb50, ftCreationTime.dwHighDateTime=0x1d4f51c, ftLastAccessTime.dwLowDateTime=0xe8837790, ftLastAccessTime.dwHighDateTime=0x1d4b46a, ftLastWriteTime.dwLowDateTime=0xe8837790, ftLastWriteTime.dwHighDateTime=0x1d4b46a, nFileSizeHigh=0x0, nFileSizeLow=0x261d, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="tSfS3txBVOn8wL_501.docx", cAlternateFileName="TSFS3T~1.DOC")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774ba600, ftCreationTime.dwHighDateTime=0x1d4c8b1, ftLastAccessTime.dwLowDateTime=0xf8f8d70, ftLastAccessTime.dwHighDateTime=0x1d4cd79, ftLastWriteTime.dwLowDateTime=0xf8f8d70, ftLastWriteTime.dwHighDateTime=0x1d4cd79, nFileSizeHigh=0x0, nFileSizeLow=0xe892, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="uea73UW-Qa5hA_JDTHP.ods", cAlternateFileName="UEA73U~1.ODS")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9516d530, ftCreationTime.dwHighDateTime=0x1d4d282, ftLastAccessTime.dwLowDateTime=0x3213b1c0, ftLastAccessTime.dwHighDateTime=0x1d4d321, ftLastWriteTime.dwLowDateTime=0x3213b1c0, ftLastWriteTime.dwHighDateTime=0x1d4d321, nFileSizeHigh=0x0, nFileSizeLow=0x139c7, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="vaCw.rtf", cAlternateFileName="")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe13200, ftCreationTime.dwHighDateTime=0x1d4cd3a, ftLastAccessTime.dwLowDateTime=0x9ea9abd0, ftLastAccessTime.dwHighDateTime=0x1d4d36e, ftLastWriteTime.dwLowDateTime=0x9ea9abd0, ftLastWriteTime.dwHighDateTime=0x1d4d36e, nFileSizeHigh=0x0, nFileSizeLow=0x11e50, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="vinoLwfUsbpS4BWLGW.doc", cAlternateFileName="VINOLW~1.DOC")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe2d8b0, ftCreationTime.dwHighDateTime=0x1d4e221, ftLastAccessTime.dwLowDateTime=0xbfce5140, ftLastAccessTime.dwHighDateTime=0x1d52764, ftLastWriteTime.dwLowDateTime=0xbfce5140, ftLastWriteTime.dwHighDateTime=0x1d52764, nFileSizeHigh=0x0, nFileSizeLow=0x8ada, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="Wb85quJcmU45C5T.xlsx", cAlternateFileName="WB85QU~1.XLS")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f3dbb40, ftCreationTime.dwHighDateTime=0x1d51653, ftLastAccessTime.dwLowDateTime=0xe3be3480, ftLastAccessTime.dwHighDateTime=0x1d4e4d4, ftLastWriteTime.dwLowDateTime=0xe3be3480, ftLastWriteTime.dwHighDateTime=0x1d4e4d4, nFileSizeHigh=0x0, nFileSizeLow=0x11a64, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="wkTfHmhLJX51r8i6Q.pptx", cAlternateFileName="WKTFHM~1.PPT")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b20a00, ftCreationTime.dwHighDateTime=0x1d4d9d7, ftLastAccessTime.dwLowDateTime=0x13e5c0d0, ftLastAccessTime.dwHighDateTime=0x1d527d1, ftLastWriteTime.dwLowDateTime=0x13e5c0d0, ftLastWriteTime.dwHighDateTime=0x1d527d1, nFileSizeHigh=0x0, nFileSizeLow=0xbd5f, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="wt5bUzyysPD.docx", cAlternateFileName="WT5BUZ~1.DOC")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee959d60, ftCreationTime.dwHighDateTime=0x1d4b5ce, ftLastAccessTime.dwLowDateTime=0xbcafe700, ftLastAccessTime.dwHighDateTime=0x1d4c4bb, ftLastWriteTime.dwLowDateTime=0xbcafe700, ftLastWriteTime.dwHighDateTime=0x1d4c4bb, nFileSizeHigh=0x0, nFileSizeLow=0xc776, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="WZ3imSrZcPAEZqerhj.xlsx", cAlternateFileName="WZ3IMS~1.XLS")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cce9790, ftCreationTime.dwHighDateTime=0x1d4c807, ftLastAccessTime.dwLowDateTime=0xcf2b69c0, ftLastAccessTime.dwHighDateTime=0x1d4d0d4, ftLastWriteTime.dwLowDateTime=0xcf2b69c0, ftLastWriteTime.dwHighDateTime=0x1d4d0d4, nFileSizeHigh=0x0, nFileSizeLow=0x806, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="X53u2qVjhd-p.xlsx", cAlternateFileName="X53U2Q~1.XLS")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3afaa10, ftCreationTime.dwHighDateTime=0x1d4cbff, ftLastAccessTime.dwLowDateTime=0xad2cd930, ftLastAccessTime.dwHighDateTime=0x1d4cc29, ftLastWriteTime.dwLowDateTime=0xad2cd930, ftLastWriteTime.dwHighDateTime=0x1d4cc29, nFileSizeHigh=0x0, nFileSizeLow=0x8c43, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="XCE6mWPwu1m.docx", cAlternateFileName="XCE6MW~1.DOC")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510f250, ftCreationTime.dwHighDateTime=0x1d4c98f, ftLastAccessTime.dwLowDateTime=0x529b8900, ftLastAccessTime.dwHighDateTime=0x1d4cb64, ftLastWriteTime.dwLowDateTime=0x529b8900, ftLastWriteTime.dwHighDateTime=0x1d4cb64, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="xt_DmRSH-_4BV2SH9.ots", cAlternateFileName="XT_DMR~1.OTS")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5332440, ftCreationTime.dwHighDateTime=0x1d526c5, ftLastAccessTime.dwLowDateTime=0xc42c5f30, ftLastAccessTime.dwHighDateTime=0x1d4c2d2, ftLastWriteTime.dwLowDateTime=0xc42c5f30, ftLastWriteTime.dwHighDateTime=0x1d4c2d2, nFileSizeHigh=0x0, nFileSizeLow=0x155e9, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="xWeKX.pptx", cAlternateFileName="XWEKX~1.PPT")) returned 1 [0042.177] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e55bcc0, ftCreationTime.dwHighDateTime=0x1d4d1de, ftLastAccessTime.dwLowDateTime=0xa41955b0, ftLastAccessTime.dwHighDateTime=0x1d4d446, ftLastWriteTime.dwLowDateTime=0xa41955b0, ftLastWriteTime.dwHighDateTime=0x1d4d446, nFileSizeHigh=0x0, nFileSizeLow=0xdbc1, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="YxcWeP1oYdIJLC6u.rtf", cAlternateFileName="YXCWEP~1.RTF")) returned 1 [0042.178] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15d1bf0, ftCreationTime.dwHighDateTime=0x1d4c9be, ftLastAccessTime.dwLowDateTime=0x62f9a6d0, ftLastAccessTime.dwHighDateTime=0x1d4c8d3, ftLastWriteTime.dwLowDateTime=0x62f9a6d0, ftLastWriteTime.dwHighDateTime=0x1d4c8d3, nFileSizeHigh=0x0, nFileSizeLow=0x11da7, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="Z1wt.ods", cAlternateFileName="")) returned 1 [0042.178] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fafd580, ftCreationTime.dwHighDateTime=0x1d4cc13, ftLastAccessTime.dwLowDateTime=0x7049acc0, ftLastAccessTime.dwHighDateTime=0x1d4eb4e, ftLastWriteTime.dwLowDateTime=0x7049acc0, ftLastWriteTime.dwHighDateTime=0x1d4eb4e, nFileSizeHigh=0x0, nFileSizeLow=0x15eb4, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="ZBK1QvsIC2F.docx", cAlternateFileName="ZBK1QV~1.DOC")) returned 1 [0042.178] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fafd580, ftCreationTime.dwHighDateTime=0x1d4cc13, ftLastAccessTime.dwLowDateTime=0x7049acc0, ftLastAccessTime.dwHighDateTime=0x1d4eb4e, ftLastWriteTime.dwLowDateTime=0x7049acc0, ftLastWriteTime.dwHighDateTime=0x1d4eb4e, nFileSizeHigh=0x0, nFileSizeLow=0x15eb4, dwReserved0=0x2e757565, dwReserved1=0x2e646875, cFileName="ZBK1QvsIC2F.docx", cAlternateFileName="ZBK1QV~1.DOC")) returned 0 [0042.178] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.178] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5617a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5617a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x636f642e, dwReserved1=0x74722e78, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0042.178] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.178] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.178] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.178] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0042.178] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.178] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e24f8*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e24f8, pdwDataLen=0x18f8e0) returned 0 [0042.178] GetLastError () returned 0xea [0042.178] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e24f8*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e24f8*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.179] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.179] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.180] SetEndOfFile (hFile=0xdc) returned 1 [0042.180] CloseHandle (hObject=0xdc) returned 1 [0042.180] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.180] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.180] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a14ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.180] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a14ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.180] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5617a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5617a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5617a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.180] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a14ed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a14ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.180] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a14ed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a14ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.180] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.180] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5617a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5617a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0042.181] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.181] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.181] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.181] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8fc0) returned 1 [0042.181] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.181] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0744*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0744, pdwDataLen=0x18f8e0) returned 0 [0042.181] GetLastError () returned 0xea [0042.181] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0744*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0744*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.182] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.182] WriteFile (in: hFile=0xdc, lpBuffer=0x33e1844*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33e1844*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.183] SetEndOfFile (hFile=0xdc) returned 1 [0042.183] CloseHandle (hObject=0xdc) returned 1 [0042.183] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.183] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.183] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a14ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.183] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a14ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.183] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5617a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5617a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5617a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.183] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a14ed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a14ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.183] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa563dbd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa563dbd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Links", cAlternateFileName="")) returned 1 [0042.183] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.184] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.184] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.184] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9140) returned 1 [0042.184] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.184] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1874*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e1874, pdwDataLen=0x18f678) returned 0 [0042.184] GetLastError () returned 0xea [0042.184] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1874*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e1874*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.184] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.185] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.186] SetEndOfFile (hFile=0xf8) returned 1 [0042.186] CloseHandle (hObject=0xf8) returned 1 [0042.186] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.186] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.186] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a14ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0042.186] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a14ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.186] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa563dbd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa563dbd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa563dbd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.186] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a14ed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a14ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.186] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0042.186] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0042.186] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0042.186] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0042.186] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x752e7972, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0042.186] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.187] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.187] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.187] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.187] CryptDestroyHash (hHash=0x5c9140) returned 1 [0042.187] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e076c*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e076c, pdwDataLen=0x18f678) returned 0 [0042.187] GetLastError () returned 0xea [0042.187] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e076c*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e076c*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.187] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.188] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.189] SetEndOfFile (hFile=0xf8) returned 1 [0042.189] CloseHandle (hObject=0xf8) returned 1 [0042.189] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.189] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.190] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a14ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.190] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a14ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.190] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a14ed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a14ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a14ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.190] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0042.190] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0042.190] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0042.190] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0042.190] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0042.190] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0042.190] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.190] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x6c72752e, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0042.190] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.191] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.191] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.191] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9140) returned 1 [0042.191] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.191] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2980*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2980, pdwDataLen=0x18f678) returned 0 [0042.191] GetLastError () returned 0xea [0042.191] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2980*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2980*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.191] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.192] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.193] SetEndOfFile (hFile=0xf8) returned 1 [0042.193] CloseHandle (hObject=0xf8) returned 1 [0042.193] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.193] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.193] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a3b030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a3b030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0042.193] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a3b030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a3b030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.193] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a3b030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a3b030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a3b030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.193] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0042.193] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0042.193] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0042.193] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0042.193] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0042.194] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0042.194] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0042.194] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0042.194] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0042.194] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.194] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.194] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.194] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.194] CryptDestroyHash (hHash=0x5c9140) returned 1 [0042.194] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1bb0*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e1bb0, pdwDataLen=0x18f678) returned 0 [0042.194] GetLastError () returned 0xea [0042.194] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1bb0*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e1bb0*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.195] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.196] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.197] SetEndOfFile (hFile=0xf8) returned 1 [0042.197] CloseHandle (hObject=0xf8) returned 1 [0042.197] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.197] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.197] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a3b030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a3b030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a3b030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a3b030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0042.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a3b030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a3b030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a3b030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0042.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0042.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0042.197] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0042.197] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.197] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0042.197] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.197] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa72a8270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa72a8270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa72ce3d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x69736265, dwReserved1=0x52736574, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.197] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5689e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5689e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69736265, dwReserved1=0x52736574, cFileName="Links", cAlternateFileName="")) returned 1 [0042.197] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.198] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.198] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.198] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0042.198] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.198] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1e48*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1e48, pdwDataLen=0x18f8e0) returned 0 [0042.198] GetLastError () returned 0xea [0042.198] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1e48*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1e48*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.198] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.199] WriteFile (in: hFile=0xdc, lpBuffer=0x33e20b0*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33e20b0*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.200] SetEndOfFile (hFile=0xdc) returned 1 [0042.200] CloseHandle (hObject=0xdc) returned 1 [0042.200] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.200] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.200] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a3b030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a3b030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.200] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a3b030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a3b030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.200] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5663d30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5663d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5663d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.200] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5663d30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5663d30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5663d30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.lnk.crypt", cAlternateFileName="DESKTO~2.CRY")) returned 1 [0042.200] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5689e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5689e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5689e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Downloads.lnk.crypt", cAlternateFileName="DOWNLO~1.CRY")) returned 1 [0042.200] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a3b030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a3b030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a3b030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.200] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5689e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5689e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5689e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RecentPlaces.lnk.crypt", cAlternateFileName="RECENT~1.CRY")) returned 1 [0042.200] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5689e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5689e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5689e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RecentPlaces.lnk.crypt", cAlternateFileName="RECENT~1.CRY")) returned 0 [0042.200] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.200] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x72632e6b, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0042.200] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.201] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.201] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.201] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8fc0) returned 1 [0042.201] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.201] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20cc*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e20cc, pdwDataLen=0x18f8e0) returned 0 [0042.201] GetLastError () returned 0xea [0042.201] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e20cc*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e20cc*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.201] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.201] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.202] SetEndOfFile (hFile=0xdc) returned 1 [0042.202] CloseHandle (hObject=0xdc) returned 1 [0042.202] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.202] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.202] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x8f\\")) returned 0xffffffff [0042.202] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5689e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5689e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="Music", cAlternateFileName="")) returned 1 [0042.202] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.203] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.203] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.203] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0042.203] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.203] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0e00*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0e00, pdwDataLen=0x18f8e0) returned 0 [0042.203] GetLastError () returned 0xea [0042.203] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0e00*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0e00*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.203] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.203] WriteFile (in: hFile=0xdc, lpBuffer=0x33e2ce4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33e2ce4*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.203] SetEndOfFile (hFile=0xdc) returned 1 [0042.203] CloseHandle (hObject=0xdc) returned 1 [0042.203] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.203] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.204] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa99c8c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99c8c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.204] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa99c8c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99c8c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.204] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4708acb0, ftCreationTime.dwHighDateTime=0x1d4d057, ftLastAccessTime.dwLowDateTime=0xc5a00b50, ftLastAccessTime.dwHighDateTime=0x1d4c994, ftLastWriteTime.dwLowDateTime=0xc5a00b50, ftLastWriteTime.dwHighDateTime=0x1d4c994, nFileSizeHigh=0x0, nFileSizeLow=0x14583, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0XsC5s_924jv0GRX.wav", cAlternateFileName="0XSC5S~1.WAV")) returned 1 [0042.204] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b49f60, ftCreationTime.dwHighDateTime=0x1d4ce5a, ftLastAccessTime.dwLowDateTime=0xefaaa150, ftLastAccessTime.dwHighDateTime=0x1d4c9ce, ftLastWriteTime.dwLowDateTime=0xefaaa150, ftLastWriteTime.dwHighDateTime=0x1d4c9ce, nFileSizeHigh=0x0, nFileSizeLow=0x613e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="125u29DHd_mnkQ.mp3", cAlternateFileName="125U29~1.MP3")) returned 1 [0042.204] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18466660, ftCreationTime.dwHighDateTime=0x1d4d4d0, ftLastAccessTime.dwLowDateTime=0x57cd87a0, ftLastAccessTime.dwHighDateTime=0x1d4cc7e, ftLastWriteTime.dwLowDateTime=0x57cd87a0, ftLastWriteTime.dwHighDateTime=0x1d4cc7e, nFileSizeHigh=0x0, nFileSizeLow=0xe17e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="3ygnHyQmz.m4a", cAlternateFileName="3YGNHY~1.M4A")) returned 1 [0042.204] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4abe1420, ftCreationTime.dwHighDateTime=0x1d4ce55, ftLastAccessTime.dwLowDateTime=0xdc9bba0, ftLastAccessTime.dwHighDateTime=0x1d4c5a4, ftLastWriteTime.dwLowDateTime=0xdc9bba0, ftLastWriteTime.dwHighDateTime=0x1d4c5a4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="4WR0EV8pyK_9X", cAlternateFileName="4WR0EV~1")) returned 1 [0042.204] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.204] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.204] CryptHashData (hHash=0x5c8fc0, pbData=0x33e27ec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.204] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9140) returned 1 [0042.204] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.204] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2584*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2584, pdwDataLen=0x18f678) returned 0 [0042.204] GetLastError () returned 0xea [0042.205] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2584*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2584*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.205] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4WR0EV8pyK_9X\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\4wr0ev8pyk_9x\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.205] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.207] SetEndOfFile (hFile=0xf8) returned 1 [0042.207] CloseHandle (hObject=0xf8) returned 1 [0042.207] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.207] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.207] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\4WR0EV8pyK_9X\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4abe1420, ftCreationTime.dwHighDateTime=0x1d4ce55, ftLastAccessTime.dwLowDateTime=0xa9a3b030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a3b030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0042.207] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4abe1420, ftCreationTime.dwHighDateTime=0x1d4ce55, ftLastAccessTime.dwLowDateTime=0xa9a3b030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a3b030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.207] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42279ee0, ftCreationTime.dwHighDateTime=0x1d4d4bc, ftLastAccessTime.dwLowDateTime=0xd8e47d10, ftLastAccessTime.dwHighDateTime=0x1d4d4e1, ftLastWriteTime.dwLowDateTime=0xd8e47d10, ftLastWriteTime.dwHighDateTime=0x1d4d4e1, nFileSizeHigh=0x0, nFileSizeLow=0x16781, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="18a595--wOsYYVi.wav", cAlternateFileName="18A595~1.WAV")) returned 1 [0042.207] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95210c20, ftCreationTime.dwHighDateTime=0x1d4c973, ftLastAccessTime.dwLowDateTime=0xbb3dba20, ftLastAccessTime.dwHighDateTime=0x1d4c7c0, ftLastWriteTime.dwLowDateTime=0xbb3dba20, ftLastWriteTime.dwHighDateTime=0x1d4c7c0, nFileSizeHigh=0x0, nFileSizeLow=0xe3ea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cX0yZfnD34NZL4l8.m4a", cAlternateFileName="CX0YZF~1.M4A")) returned 1 [0042.207] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a3b030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a3b030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a61190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.207] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b67fe0, ftCreationTime.dwHighDateTime=0x1d4cfb4, ftLastAccessTime.dwLowDateTime=0xfd22ff0, ftLastAccessTime.dwHighDateTime=0x1d4d093, ftLastWriteTime.dwLowDateTime=0xfd22ff0, ftLastWriteTime.dwHighDateTime=0x1d4d093, nFileSizeHigh=0x0, nFileSizeLow=0x1887e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="VoKgSnN0GRMpo.m4a", cAlternateFileName="VOKGSN~1.M4A")) returned 1 [0042.207] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd44027c0, ftCreationTime.dwHighDateTime=0x1d4cf4e, ftLastAccessTime.dwLowDateTime=0xb8dcad70, ftLastAccessTime.dwHighDateTime=0x1d4ce07, ftLastWriteTime.dwLowDateTime=0xb8dcad70, ftLastWriteTime.dwHighDateTime=0x1d4ce07, nFileSizeHigh=0x0, nFileSizeLow=0x3f6f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="W7wXV705BYEv_u-.mp3", cAlternateFileName="W7WXV7~1.MP3")) returned 1 [0042.207] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b633ff0, ftCreationTime.dwHighDateTime=0x1d4d52e, ftLastAccessTime.dwLowDateTime=0x61ce1030, ftLastAccessTime.dwHighDateTime=0x1d4d007, ftLastWriteTime.dwLowDateTime=0x61ce1030, ftLastWriteTime.dwHighDateTime=0x1d4d007, nFileSizeHigh=0x0, nFileSizeLow=0x9d93, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ytQapqIa_oXfRG-.mp3", cAlternateFileName="YTQAPQ~1.MP3")) returned 1 [0042.207] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b633ff0, ftCreationTime.dwHighDateTime=0x1d4d52e, ftLastAccessTime.dwLowDateTime=0x61ce1030, ftLastAccessTime.dwHighDateTime=0x1d4d007, ftLastWriteTime.dwLowDateTime=0x61ce1030, ftLastWriteTime.dwHighDateTime=0x1d4d007, nFileSizeHigh=0x0, nFileSizeLow=0x9d93, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ytQapqIa_oXfRG-.mp3", cAlternateFileName="YTQAPQ~1.MP3")) returned 0 [0042.207] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0042.207] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5689e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5689e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5689e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x2d475266, dwReserved1=0x33706d2e, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.208] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e794e0, ftCreationTime.dwHighDateTime=0x1d4d2d3, ftLastAccessTime.dwLowDateTime=0x3f96f800, ftLastAccessTime.dwHighDateTime=0x1d4caef, ftLastWriteTime.dwLowDateTime=0x3f96f800, ftLastWriteTime.dwHighDateTime=0x1d4caef, nFileSizeHigh=0x0, nFileSizeLow=0x17ff4, dwReserved0=0x2d475266, dwReserved1=0x33706d2e, cFileName="GWiU2OqK7YyNgn.mp3", cAlternateFileName="GWIU2O~1.MP3")) returned 1 [0042.208] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99c8c10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99c8c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a3b030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2d475266, dwReserved1=0x33706d2e, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.208] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50516080, ftCreationTime.dwHighDateTime=0x1d4cf0a, ftLastAccessTime.dwLowDateTime=0x86e69390, ftLastAccessTime.dwHighDateTime=0x1d4cf23, ftLastWriteTime.dwLowDateTime=0x86e69390, ftLastWriteTime.dwHighDateTime=0x1d4cf23, nFileSizeHigh=0x0, nFileSizeLow=0x421a, dwReserved0=0x2d475266, dwReserved1=0x33706d2e, cFileName="jsm-A.wav", cAlternateFileName="")) returned 1 [0042.208] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe73ee00, ftCreationTime.dwHighDateTime=0x1d4d264, ftLastAccessTime.dwLowDateTime=0xd5c75880, ftLastAccessTime.dwHighDateTime=0x1d4d376, ftLastWriteTime.dwLowDateTime=0xd5c75880, ftLastWriteTime.dwHighDateTime=0x1d4d376, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d475266, dwReserved1=0x33706d2e, cFileName="m1LcNfC15e9dwL", cAlternateFileName="M1LCNF~1")) returned 1 [0042.208] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.208] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.208] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.208] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8fc0) returned 1 [0042.208] CryptDestroyHash (hHash=0x5c9140) returned 1 [0042.208] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0a7c*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e0a7c, pdwDataLen=0x18f678) returned 0 [0042.208] GetLastError () returned 0xea [0042.208] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0a7c*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e0a7c*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.209] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\m1LcNfC15e9dwL\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\m1lcnfc15e9dwl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.209] WriteFile (in: hFile=0xf8, lpBuffer=0x33e1494*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33e1494*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.210] SetEndOfFile (hFile=0xf8) returned 1 [0042.210] CloseHandle (hObject=0xf8) returned 1 [0042.210] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.210] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.210] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\m1LcNfC15e9dwL\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe73ee00, ftCreationTime.dwHighDateTime=0x1d4d264, ftLastAccessTime.dwLowDateTime=0xa9a61190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a61190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.210] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe73ee00, ftCreationTime.dwHighDateTime=0x1d4d264, ftLastAccessTime.dwLowDateTime=0xa9a61190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a61190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.210] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506bab40, ftCreationTime.dwHighDateTime=0x1d4c9a4, ftLastAccessTime.dwLowDateTime=0x29629660, ftLastAccessTime.dwHighDateTime=0x1d4c7b2, ftLastWriteTime.dwLowDateTime=0x29629660, ftLastWriteTime.dwHighDateTime=0x1d4c7b2, nFileSizeHigh=0x0, nFileSizeLow=0xd06e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="-PAbKQMQvuXH.mp3", cAlternateFileName="-PABKQ~1.MP3")) returned 1 [0042.210] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc1313e0, ftCreationTime.dwHighDateTime=0x1d4d1c4, ftLastAccessTime.dwLowDateTime=0x3232ff60, ftLastAccessTime.dwHighDateTime=0x1d4c8f6, ftLastWriteTime.dwLowDateTime=0x3232ff60, ftLastWriteTime.dwHighDateTime=0x1d4c8f6, nFileSizeHigh=0x0, nFileSizeLow=0x4561, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1Howj.wav", cAlternateFileName="")) returned 1 [0042.210] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafd8ab10, ftCreationTime.dwHighDateTime=0x1d4c8c2, ftLastAccessTime.dwLowDateTime=0x9502720, ftLastAccessTime.dwHighDateTime=0x1d4cf78, ftLastWriteTime.dwLowDateTime=0x9502720, ftLastWriteTime.dwHighDateTime=0x1d4cf78, nFileSizeHigh=0x0, nFileSizeLow=0x18acc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="boMs.mp3", cAlternateFileName="")) returned 1 [0042.210] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb53d2b0, ftCreationTime.dwHighDateTime=0x1d4d3ab, ftLastAccessTime.dwLowDateTime=0x5704b390, ftLastAccessTime.dwHighDateTime=0x1d4cce5, ftLastWriteTime.dwLowDateTime=0x5704b390, ftLastWriteTime.dwHighDateTime=0x1d4cce5, nFileSizeHigh=0x0, nFileSizeLow=0x14690, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="C5IU6Fp.wav", cAlternateFileName="")) returned 1 [0042.210] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a61190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a61190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a61190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.210] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f26aa00, ftCreationTime.dwHighDateTime=0x1d4d4da, ftLastAccessTime.dwLowDateTime=0xd4d7b5f0, ftLastAccessTime.dwHighDateTime=0x1d4c881, ftLastWriteTime.dwLowDateTime=0xd4d7b5f0, ftLastWriteTime.dwHighDateTime=0x1d4c881, nFileSizeHigh=0x0, nFileSizeLow=0xcf8f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Imu5.wav", cAlternateFileName="")) returned 1 [0042.210] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb259e480, ftCreationTime.dwHighDateTime=0x1d4cf61, ftLastAccessTime.dwLowDateTime=0xc7010670, ftLastAccessTime.dwHighDateTime=0x1d4d34e, ftLastWriteTime.dwLowDateTime=0xc7010670, ftLastWriteTime.dwHighDateTime=0x1d4d34e, nFileSizeHigh=0x0, nFileSizeLow=0x131dc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="JHFevy5nBWsYXkQuXD9.mp3", cAlternateFileName="JHFEVY~1.MP3")) returned 1 [0042.211] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe707b5d0, ftCreationTime.dwHighDateTime=0x1d4d39f, ftLastAccessTime.dwLowDateTime=0xba494880, ftLastAccessTime.dwHighDateTime=0x1d4d528, ftLastWriteTime.dwLowDateTime=0xba494880, ftLastWriteTime.dwHighDateTime=0x1d4d528, nFileSizeHigh=0x0, nFileSizeLow=0x1d6d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="T8AizuA7Lu5772G.wav", cAlternateFileName="T8AIZU~1.WAV")) returned 1 [0042.211] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b1636c0, ftCreationTime.dwHighDateTime=0x1d4c69b, ftLastAccessTime.dwLowDateTime=0x8b299bd0, ftLastAccessTime.dwHighDateTime=0x1d4c55c, ftLastWriteTime.dwLowDateTime=0x8b299bd0, ftLastWriteTime.dwHighDateTime=0x1d4c55c, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="VH5ALO.mp3", cAlternateFileName="")) returned 1 [0042.211] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f96c10, ftCreationTime.dwHighDateTime=0x1d4ca4d, ftLastAccessTime.dwLowDateTime=0xf5ec4230, ftLastAccessTime.dwHighDateTime=0x1d4d1ee, ftLastWriteTime.dwLowDateTime=0xf5ec4230, ftLastWriteTime.dwHighDateTime=0x1d4d1ee, nFileSizeHigh=0x0, nFileSizeLow=0x7be2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="zg26LXXgtcYMWW3C_ZN.m4a", cAlternateFileName="ZG26LX~1.M4A")) returned 1 [0042.211] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366a16b0, ftCreationTime.dwHighDateTime=0x1d4d3e9, ftLastAccessTime.dwLowDateTime=0x91e1a940, ftLastAccessTime.dwHighDateTime=0x1d4c539, ftLastWriteTime.dwLowDateTime=0x91e1a940, ftLastWriteTime.dwHighDateTime=0x1d4c539, nFileSizeHigh=0x0, nFileSizeLow=0xabb8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="__6nSD4.wav", cAlternateFileName="")) returned 1 [0042.211] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x366a16b0, ftCreationTime.dwHighDateTime=0x1d4d3e9, ftLastAccessTime.dwLowDateTime=0x91e1a940, ftLastAccessTime.dwHighDateTime=0x1d4c539, ftLastWriteTime.dwLowDateTime=0x91e1a940, ftLastWriteTime.dwHighDateTime=0x1d4c539, nFileSizeHigh=0x0, nFileSizeLow=0xabb8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="__6nSD4.wav", cAlternateFileName="")) returned 0 [0042.211] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.211] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52b50570, ftCreationTime.dwHighDateTime=0x1d4d2ac, ftLastAccessTime.dwLowDateTime=0x1c765140, ftLastAccessTime.dwHighDateTime=0x1d4cb08, ftLastWriteTime.dwLowDateTime=0x1c765140, ftLastWriteTime.dwHighDateTime=0x1d4cb08, nFileSizeHigh=0x0, nFileSizeLow=0x17ac3, dwReserved0=0x3357574d, dwReserved1=0x4e5a5f43, cFileName="mcvrinqy.m4a", cAlternateFileName="")) returned 1 [0042.211] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e899b60, ftCreationTime.dwHighDateTime=0x1d4caa8, ftLastAccessTime.dwLowDateTime=0xd0d94140, ftLastAccessTime.dwHighDateTime=0x1d4cb78, ftLastWriteTime.dwLowDateTime=0xd0d94140, ftLastWriteTime.dwHighDateTime=0x1d4cb78, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3357574d, dwReserved1=0x4e5a5f43, cFileName="UIN", cAlternateFileName="")) returned 1 [0042.211] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.211] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.211] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.211] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9140) returned 1 [0042.211] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.211] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f6c*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2f6c, pdwDataLen=0x18f678) returned 0 [0042.212] GetLastError () returned 0xea [0042.212] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f6c*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2f6c*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.212] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UIN\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uin\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.212] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.213] SetEndOfFile (hFile=0xf8) returned 1 [0042.213] CloseHandle (hObject=0xf8) returned 1 [0042.213] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.213] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.213] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UIN\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e899b60, ftCreationTime.dwHighDateTime=0x1d4caa8, ftLastAccessTime.dwLowDateTime=0xa9a61190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a61190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0042.213] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e899b60, ftCreationTime.dwHighDateTime=0x1d4caa8, ftLastAccessTime.dwLowDateTime=0xa9a61190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a61190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.213] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a61190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a61190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a61190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.214] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dccc7e0, ftCreationTime.dwHighDateTime=0x1d4c86e, ftLastAccessTime.dwLowDateTime=0x96fd53e0, ftLastAccessTime.dwHighDateTime=0x1d4c7cb, ftLastWriteTime.dwLowDateTime=0x96fd53e0, ftLastWriteTime.dwHighDateTime=0x1d4c7cb, nFileSizeHigh=0x0, nFileSizeLow=0x170d9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ic--vnuNibIAvHMo.m4a", cAlternateFileName="IC--VN~1.M4A")) returned 1 [0042.214] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f12c960, ftCreationTime.dwHighDateTime=0x1d4d12f, ftLastAccessTime.dwLowDateTime=0xdfad8980, ftLastAccessTime.dwHighDateTime=0x1d4d0e4, ftLastWriteTime.dwLowDateTime=0xdfad8980, ftLastWriteTime.dwHighDateTime=0x1d4d0e4, nFileSizeHigh=0x0, nFileSizeLow=0xc09e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PDX0mkOg3Hw.mp3", cAlternateFileName="PDX0MK~1.MP3")) returned 1 [0042.214] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1de3a9f0, ftCreationTime.dwHighDateTime=0x1d4c744, ftLastAccessTime.dwLowDateTime=0x86d45bd0, ftLastAccessTime.dwHighDateTime=0x1d4d39c, ftLastWriteTime.dwLowDateTime=0x86d45bd0, ftLastWriteTime.dwHighDateTime=0x1d4d39c, nFileSizeHigh=0x0, nFileSizeLow=0x9639, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="pIS9JaYO3meJ733a.m4a", cAlternateFileName="PIS9JA~1.M4A")) returned 1 [0042.214] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c99be00, ftCreationTime.dwHighDateTime=0x1d4c804, ftLastAccessTime.dwLowDateTime=0x84e19da0, ftLastAccessTime.dwHighDateTime=0x1d4ca06, ftLastWriteTime.dwLowDateTime=0x84e19da0, ftLastWriteTime.dwHighDateTime=0x1d4ca06, nFileSizeHigh=0x0, nFileSizeLow=0x181c9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="XvqWYaAAFozS.wav", cAlternateFileName="XVQWYA~1.WAV")) returned 1 [0042.214] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c99be00, ftCreationTime.dwHighDateTime=0x1d4c804, ftLastAccessTime.dwLowDateTime=0x84e19da0, ftLastAccessTime.dwHighDateTime=0x1d4ca06, ftLastWriteTime.dwLowDateTime=0x84e19da0, ftLastWriteTime.dwHighDateTime=0x1d4ca06, nFileSizeHigh=0x0, nFileSizeLow=0x181c9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="XvqWYaAAFozS.wav", cAlternateFileName="XVQWYA~1.WAV")) returned 0 [0042.214] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0042.214] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46969e10, ftCreationTime.dwHighDateTime=0x1d4d546, ftLastAccessTime.dwLowDateTime=0x3328b8a0, ftLastAccessTime.dwHighDateTime=0x1d4c596, ftLastWriteTime.dwLowDateTime=0x3328b8a0, ftLastWriteTime.dwHighDateTime=0x1d4c596, nFileSizeHigh=0x0, nFileSizeLow=0xd835, dwReserved0=0x61772e53, dwReserved1=0x346d2e76, cFileName="XUD6Ym8ZydDIAh.wav", cAlternateFileName="XUD6YM~1.WAV")) returned 1 [0042.214] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46969e10, ftCreationTime.dwHighDateTime=0x1d4d546, ftLastAccessTime.dwLowDateTime=0x3328b8a0, ftLastAccessTime.dwHighDateTime=0x1d4c596, ftLastWriteTime.dwLowDateTime=0x3328b8a0, ftLastWriteTime.dwHighDateTime=0x1d4c596, nFileSizeHigh=0x0, nFileSizeLow=0xd835, dwReserved0=0x61772e53, dwReserved1=0x346d2e76, cFileName="XUD6Ym8ZydDIAh.wav", cAlternateFileName="XUD6YM~1.WAV")) returned 0 [0042.214] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.214] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52766177, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0042.214] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.214] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.214] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.214] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c9140) returned 1 [0042.215] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.215] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2550*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2550, pdwDataLen=0x18f8e0) returned 0 [0042.215] GetLastError () returned 0xea [0042.215] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2550*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2550*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.215] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.215] WriteFile (in: hFile=0xdc, lpBuffer=0x33e2f68*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33e2f68*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.215] SetEndOfFile (hFile=0xdc) returned 1 [0042.215] CloseHandle (hObject=0xdc) returned 1 [0042.215] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.215] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.215] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x8f\\")) returned 0xffffffff [0042.216] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x183, cFileName="NetHood", cAlternateFileName="")) returned 1 [0042.216] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.216] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.216] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.216] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0042.216] CryptDestroyHash (hHash=0x5c9140) returned 1 [0042.216] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2808*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2808, pdwDataLen=0x18f8e0) returned 0 [0042.216] GetLastError () returned 0xea [0042.216] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2808*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2808*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.217] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\nethood\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.217] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.217] SetEndOfFile (hFile=0xdc) returned 1 [0042.217] CloseHandle (hObject=0xdc) returned 1 [0042.217] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.217] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.217] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x8f\\")) returned 0xffffffff [0042.217] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x3, dwReserved1=0x183, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0042.217] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x3, dwReserved1=0x183, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0042.217] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0042.217] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x3, dwReserved1=0x183, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0042.217] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x3, dwReserved1=0x183, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0042.217] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x3, dwReserved1=0x183, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0042.217] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56afff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa56afff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa56afff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x3, dwReserved1=0x183, cFileName="ntuser.ini.crypt", cAlternateFileName="NTUSER~1.CRY")) returned 1 [0042.217] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa58c5330, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa58c5330, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="Pictures", cAlternateFileName="")) returned 1 [0042.217] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.218] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.218] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.218] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c9140) returned 1 [0042.218] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.218] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18f8e0) returned 0 [0042.218] GetLastError () returned 0xea [0042.218] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.218] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.219] WriteFile (in: hFile=0xdc, lpBuffer=0x33e13f4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33e13f4*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.219] SetEndOfFile (hFile=0xdc) returned 1 [0042.219] CloseHandle (hObject=0xdc) returned 1 [0042.219] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.219] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.219] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99eed70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0042.219] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99eed70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.219] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39b64f0, ftCreationTime.dwHighDateTime=0x1d4d0c4, ftLastAccessTime.dwLowDateTime=0x552bd9f0, ftLastAccessTime.dwHighDateTime=0x1d4c708, ftLastWriteTime.dwLowDateTime=0x552bd9f0, ftLastWriteTime.dwHighDateTime=0x1d4c708, nFileSizeHigh=0x0, nFileSizeLow=0x8f45, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1k4R.gif", cAlternateFileName="")) returned 1 [0042.219] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbbdb960, ftCreationTime.dwHighDateTime=0x1d4ca4e, ftLastAccessTime.dwLowDateTime=0x43dde5d0, ftLastAccessTime.dwHighDateTime=0x1d4cc76, ftLastWriteTime.dwLowDateTime=0x43dde5d0, ftLastWriteTime.dwHighDateTime=0x1d4cc76, nFileSizeHigh=0x0, nFileSizeLow=0x108e9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7pxElmPL-Wwhu0MBGln.bmp", cAlternateFileName="7PXELM~1.BMP")) returned 1 [0042.219] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56afff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa56afff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa56afff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x121a8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="czX2gsVPMSP9d.png.crypt", cAlternateFileName="CZX2GS~1.CRY")) returned 1 [0042.219] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56d6150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa56d6150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa56d6150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.219] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56d6150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa56d6150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa56d6150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1289c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Dg3vL1ig5.png.crypt", cAlternateFileName="DG3VL1~1.CRY")) returned 1 [0042.219] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ef19650, ftCreationTime.dwHighDateTime=0x1d4cc5a, ftLastAccessTime.dwLowDateTime=0xa57ba990, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa57ba990, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="EbgPE9V15_kcIv3u6EhR", cAlternateFileName="EBGPE9~1")) returned 1 [0042.219] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.220] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.220] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.220] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8fc0) returned 1 [0042.220] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.220] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07d4*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e07d4, pdwDataLen=0x18f678) returned 0 [0042.220] GetLastError () returned 0xea [0042.220] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e07d4*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e07d4*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.220] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ebgpe9v15_kciv3u6ehr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.221] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.222] SetEndOfFile (hFile=0xf8) returned 1 [0042.222] CloseHandle (hObject=0xf8) returned 1 [0042.222] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.222] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.222] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EbgPE9V15_kcIv3u6EhR\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ef19650, ftCreationTime.dwHighDateTime=0x1d4cc5a, ftLastAccessTime.dwLowDateTime=0xa9a61190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a61190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.222] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ef19650, ftCreationTime.dwHighDateTime=0x1d4cc5a, ftLastAccessTime.dwLowDateTime=0xa9a61190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a61190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56d6150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa56d6150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa56fc2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xa5c0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="2YTf5ryi8j8c45B6Xqk1.png.crypt", cAlternateFileName="2YTF5R~1.CRY")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56fc2b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa56fc2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa56fc2b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x3b38, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Dl_7dNsKCTJ_j79tbg8.png.crypt", cAlternateFileName="DL_7DN~1.CRY")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x503f4340, ftCreationTime.dwHighDateTime=0x1d4d127, ftLastAccessTime.dwLowDateTime=0xb1e9d910, ftLastAccessTime.dwHighDateTime=0x1d4d44d, ftLastWriteTime.dwLowDateTime=0xb1e9d910, ftLastWriteTime.dwHighDateTime=0x1d4d44d, nFileSizeHigh=0x0, nFileSizeLow=0xd1bc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="grU9T.gif", cAlternateFileName="")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56fc2b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa56fc2b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5722410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x124df, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="hG7YH.png.crypt", cAlternateFileName="HG7YHP~1.CRY")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a61190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a61190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a61190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5722410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5722410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5748570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xebc4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="itujVDK1.png.crypt", cAlternateFileName="ITUJVD~1.CRY")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2055d5e0, ftCreationTime.dwHighDateTime=0x1d4ceac, ftLastAccessTime.dwLowDateTime=0x7db05b70, ftLastAccessTime.dwHighDateTime=0x1d4ceb1, ftLastWriteTime.dwLowDateTime=0x7db05b70, ftLastWriteTime.dwHighDateTime=0x1d4ceb1, nFileSizeHigh=0x0, nFileSizeLow=0x1142e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="N0tyvu.bmp", cAlternateFileName="")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1603a350, ftCreationTime.dwHighDateTime=0x1d4d254, ftLastAccessTime.dwLowDateTime=0x79516f30, ftLastAccessTime.dwHighDateTime=0x1d4d2c4, ftLastWriteTime.dwLowDateTime=0x79516f30, ftLastWriteTime.dwHighDateTime=0x1d4d2c4, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="nOlSru49ZI7Mce.bmp", cAlternateFileName="NOLSRU~1.BMP")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5748570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5748570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5748570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x435a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="OSbShf5y0ZH.png.crypt", cAlternateFileName="OSBSHF~1.CRY")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5748570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5748570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa576e6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x11fb8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="QFEDUHr5Z.png.crypt", cAlternateFileName="QFEDUH~1.CRY")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa576e6d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa576e6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa576e6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x11837, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="tlYEuU.jpg.crypt", cAlternateFileName="TLYEUU~1.CRY")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b3dc130, ftCreationTime.dwHighDateTime=0x1d4d1d3, ftLastAccessTime.dwLowDateTime=0xf1fb0410, ftLastAccessTime.dwHighDateTime=0x1d4ca49, ftLastWriteTime.dwLowDateTime=0xf1fb0410, ftLastWriteTime.dwHighDateTime=0x1d4ca49, nFileSizeHigh=0x0, nFileSizeLow=0x7ba2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="tMuxzgPEV.gif", cAlternateFileName="TMUXZG~1.GIF")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa57ba990, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa57ba990, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa57ba990, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a6b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WPT7UafYBGl.jpg.crypt", cAlternateFileName="WPT7UA~1.CRY")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5faf350, ftCreationTime.dwHighDateTime=0x1d4c602, ftLastAccessTime.dwLowDateTime=0xb25aed40, ftLastAccessTime.dwHighDateTime=0x1d4c97f, ftLastWriteTime.dwLowDateTime=0xb25aed40, ftLastWriteTime.dwHighDateTime=0x1d4c97f, nFileSizeHigh=0x0, nFileSizeLow=0x136af, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="zGYsNXFxx3.bmp", cAlternateFileName="ZGYSNX~1.BMP")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5faf350, ftCreationTime.dwHighDateTime=0x1d4c602, ftLastAccessTime.dwLowDateTime=0xb25aed40, ftLastAccessTime.dwHighDateTime=0x1d4c97f, ftLastWriteTime.dwLowDateTime=0xb25aed40, ftLastWriteTime.dwHighDateTime=0x1d4c97f, nFileSizeHigh=0x0, nFileSizeLow=0x136af, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="zGYsNXFxx3.bmp", cAlternateFileName="ZGYSNX~1.BMP")) returned 0 [0042.223] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa57ba990, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa57ba990, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa57e0af0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7d5c, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="eovezfgn1Aazt5.png.crypt", cAlternateFileName="EOVEZF~1.CRY")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa57e0af0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa57e0af0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa57e0af0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x129a2, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="fp6DzYig6j9.png.crypt", cAlternateFileName="FP6DZY~1.CRY")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5806c50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5806c50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5806c50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbd8b, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="FtJuB8_WULa.jpg.crypt", cAlternateFileName="FTJUB8~1.CRY")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99eed70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a61190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.223] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d942c70, ftCreationTime.dwHighDateTime=0x1d4d29f, ftLastAccessTime.dwLowDateTime=0x45fecd10, ftLastAccessTime.dwHighDateTime=0x1d4d2e4, ftLastWriteTime.dwLowDateTime=0x45fecd10, ftLastWriteTime.dwHighDateTime=0x1d4d2e4, nFileSizeHigh=0x0, nFileSizeLow=0x93a3, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="I f1ZnX-HR.bmp", cAlternateFileName="IF1ZNX~1.BMP")) returned 1 [0042.224] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5806c50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5806c50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5806c50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x6041, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="McWc.jpg.crypt", cAlternateFileName="MCWCJP~1.CRY")) returned 1 [0042.224] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4989e10, ftCreationTime.dwHighDateTime=0x1d4d38c, ftLastAccessTime.dwLowDateTime=0xb7723ee0, ftLastAccessTime.dwHighDateTime=0x1d4d4d4, ftLastWriteTime.dwLowDateTime=0xb7723ee0, ftLastWriteTime.dwHighDateTime=0x1d4d4d4, nFileSizeHigh=0x0, nFileSizeLow=0x1355, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="Qc87LZYu5MnLTcCw5Q.gif", cAlternateFileName="QC87LZ~1.GIF")) returned 1 [0042.224] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa582cdb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa582cdb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5852f10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x161d7, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="rfTi4jYQDV0uM8w0K.jpg.crypt", cAlternateFileName="RFTI4J~1.CRY")) returned 1 [0042.224] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5852f10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5852f10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5879070, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x17dd4, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="tvoXA_h.png.crypt", cAlternateFileName="TVOXA_~1.CRY")) returned 1 [0042.224] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fdce020, ftCreationTime.dwHighDateTime=0x1d4d365, ftLastAccessTime.dwLowDateTime=0x784ee770, ftLastAccessTime.dwHighDateTime=0x1d4c58b, ftLastWriteTime.dwLowDateTime=0x784ee770, ftLastWriteTime.dwHighDateTime=0x1d4c58b, nFileSizeHigh=0x0, nFileSizeLow=0x7b64, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="VHqzI_mN.bmp", cAlternateFileName="")) returned 1 [0042.224] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5879070, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5879070, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa589f1d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x168a8, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="WRWYt_i7n2.png.crypt", cAlternateFileName="WRWYT_~1.CRY")) returned 1 [0042.224] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa589f1d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa589f1d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa589f1d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x18212, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="XsD0o5hKl2npcDCg2IIF.jpg.crypt", cAlternateFileName="XSD0O5~1.CRY")) returned 1 [0042.224] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa58c5330, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa58c5330, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa58c5330, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x18714, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="XY9FEIK2DpgtI.png.crypt", cAlternateFileName="XY9FEI~1.CRY")) returned 1 [0042.224] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa58c5330, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa58c5330, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa58c5330, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x18714, dwReserved0=0x67706d62, dwReserved1=0x7972632e, cFileName="XY9FEIK2DpgtI.png.crypt", cAlternateFileName="XY9FEI~1.CRY")) returned 0 [0042.224] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0042.224] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x632e676e, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0042.224] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.224] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.225] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.225] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8fc0) returned 1 [0042.225] CryptDestroyHash (hHash=0x5c9140) returned 1 [0042.225] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1190*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1190, pdwDataLen=0x18f8e0) returned 0 [0042.225] GetLastError () returned 0xea [0042.225] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1190*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1190*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.225] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\printhood\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.225] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.225] SetEndOfFile (hFile=0xdc) returned 1 [0042.226] CloseHandle (hObject=0xdc) returned 1 [0042.226] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.226] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.226] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x8f\\")) returned 0xffffffff [0042.226] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x183, cFileName="Recent", cAlternateFileName="")) returned 1 [0042.226] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.226] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.226] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.226] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c9140) returned 1 [0042.226] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.226] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1474*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1474, pdwDataLen=0x18f8e0) returned 0 [0042.226] GetLastError () returned 0xea [0042.227] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1474*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1474*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.227] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\recent\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.227] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.227] SetEndOfFile (hFile=0xdc) returned 1 [0042.227] CloseHandle (hObject=0xdc) returned 1 [0042.227] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.227] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.227] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x8f\\")) returned 0xffffffff [0042.227] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa58eb490, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa58eb490, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0042.227] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.228] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.228] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.228] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8fc0) returned 1 [0042.228] CryptDestroyHash (hHash=0x5c9140) returned 1 [0042.228] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18f8e0) returned 0 [0042.228] GetLastError () returned 0xea [0042.228] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.228] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.229] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.230] SetEndOfFile (hFile=0xdc) returned 1 [0042.230] CloseHandle (hObject=0xdc) returned 1 [0042.230] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.230] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.230] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a872f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a872f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.230] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a872f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a872f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.230] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa58c5330, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa58c5330, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa58eb490, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.230] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a872f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a872f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a872f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.230] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a872f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a872f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a872f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.230] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.230] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa58eb490, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa58eb490, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Searches", cAlternateFileName="")) returned 1 [0042.230] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.231] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.231] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.231] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c9140) returned 1 [0042.231] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.231] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0744*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0744, pdwDataLen=0x18f8e0) returned 0 [0042.231] GetLastError () returned 0xea [0042.231] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0744*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0744*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.231] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.232] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.232] SetEndOfFile (hFile=0xdc) returned 1 [0042.233] CloseHandle (hObject=0xdc) returned 1 [0042.233] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.233] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.233] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a872f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a872f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0042.233] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9a872f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a872f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.233] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa58eb490, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa58eb490, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa58eb490, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.233] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0042.233] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9a872f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9a872f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9a872f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.233] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0042.233] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0042.233] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0042.233] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="SendTo", cAlternateFileName="")) returned 1 [0042.233] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.235] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.235] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.235] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8fc0) returned 1 [0042.235] CryptDestroyHash (hHash=0x5c9140) returned 1 [0042.235] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e112c*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e112c, pdwDataLen=0x18f8e0) returned 0 [0042.235] GetLastError () returned 0xea [0042.235] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e112c*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e112c*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.235] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\sendto\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.236] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.236] SetEndOfFile (hFile=0xdc) returned 1 [0042.236] CloseHandle (hObject=0xdc) returned 1 [0042.236] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.236] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.236] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x8f\\")) returned 0xffffffff [0042.236] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x183, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0042.236] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.237] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.237] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.237] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c9140) returned 1 [0042.237] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.237] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1780*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1780, pdwDataLen=0x18f8e0) returned 0 [0042.237] GetLastError () returned 0xea [0042.237] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1780*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1780*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.237] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\start menu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.237] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.237] SetEndOfFile (hFile=0xdc) returned 1 [0042.238] CloseHandle (hObject=0xdc) returned 1 [0042.238] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.238] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.238] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x8f\\")) returned 0xffffffff [0042.238] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x183, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0042.238] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.239] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.239] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.239] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8fc0) returned 1 [0042.239] CryptDestroyHash (hHash=0x5c9140) returned 1 [0042.239] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1df8*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1df8, pdwDataLen=0x18f8e0) returned 0 [0042.239] GetLastError () returned 0xea [0042.239] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1df8*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1df8*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.239] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\templates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.239] WriteFile (in: hFile=0xdc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.239] SetEndOfFile (hFile=0xdc) returned 1 [0042.239] CloseHandle (hObject=0xdc) returned 1 [0042.240] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.240] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.240] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x8f\\")) returned 0xffffffff [0042.240] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa58eb490, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa58eb490, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="Videos", cAlternateFileName="")) returned 1 [0042.240] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.240] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.240] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.240] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c9140) returned 1 [0042.240] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.240] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1dac*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1dac, pdwDataLen=0x18f8e0) returned 0 [0042.240] GetLastError () returned 0xea [0042.240] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1dac*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1dac*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.241] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.241] WriteFile (in: hFile=0xdc, lpBuffer=0x33e0d78*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33e0d78*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.241] SetEndOfFile (hFile=0xdc) returned 1 [0042.241] CloseHandle (hObject=0xdc) returned 1 [0042.241] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.241] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.241] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99eed70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0042.241] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa99eed70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.241] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8f8f3f0, ftCreationTime.dwHighDateTime=0x1d4d302, ftLastAccessTime.dwLowDateTime=0xaa05c350, ftLastAccessTime.dwHighDateTime=0x1d4c6bd, ftLastWriteTime.dwLowDateTime=0xaa05c350, ftLastWriteTime.dwHighDateTime=0x1d4c6bd, nFileSizeHigh=0x0, nFileSizeLow=0x1827, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5okAbAjGF7dXMESSH7p1.swf", cAlternateFileName="5OKABA~1.SWF")) returned 1 [0042.241] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbed70, ftCreationTime.dwHighDateTime=0x1d4d068, ftLastAccessTime.dwLowDateTime=0xd7d68f10, ftLastAccessTime.dwHighDateTime=0x1d4c6b5, ftLastWriteTime.dwLowDateTime=0xd7d68f10, ftLastWriteTime.dwHighDateTime=0x1d4c6b5, nFileSizeHigh=0x0, nFileSizeLow=0x83c4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AwhcK6mbhp1Hc cwf4c.avi", cAlternateFileName="AWHCK6~1.AVI")) returned 1 [0042.241] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc00e220, ftCreationTime.dwHighDateTime=0x1d4c9c6, ftLastAccessTime.dwLowDateTime=0x18f291b0, ftLastAccessTime.dwHighDateTime=0x1d4d41c, ftLastWriteTime.dwLowDateTime=0x18f291b0, ftLastWriteTime.dwHighDateTime=0x1d4d41c, nFileSizeHigh=0x0, nFileSizeLow=0x65a3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BTGLO1I4z9S60.mkv", cAlternateFileName="BTGLO1~1.MKV")) returned 1 [0042.241] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa58eb490, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa58eb490, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa58eb490, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.241] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa99eed70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa99eed70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9aad450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.241] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b55390, ftCreationTime.dwHighDateTime=0x1d4d3e2, ftLastAccessTime.dwLowDateTime=0x23c873f0, ftLastAccessTime.dwHighDateTime=0x1d4d108, ftLastWriteTime.dwLowDateTime=0x23c873f0, ftLastWriteTime.dwHighDateTime=0x1d4d108, nFileSizeHigh=0x0, nFileSizeLow=0x98d2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="hzTuwy- b.avi", cAlternateFileName="HZTUWY~1.AVI")) returned 1 [0042.241] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cacde30, ftCreationTime.dwHighDateTime=0x1d4c7bf, ftLastAccessTime.dwLowDateTime=0x22872360, ftLastAccessTime.dwHighDateTime=0x1d4c88e, ftLastWriteTime.dwLowDateTime=0x22872360, ftLastWriteTime.dwHighDateTime=0x1d4c88e, nFileSizeHigh=0x0, nFileSizeLow=0x1550d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="k8qWPZoJVU.mp4", cAlternateFileName="K8QWPZ~1.MP4")) returned 1 [0042.242] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfb89d60, ftCreationTime.dwHighDateTime=0x1d4d513, ftLastAccessTime.dwLowDateTime=0xca573370, ftLastAccessTime.dwHighDateTime=0x1d4ca94, ftLastWriteTime.dwLowDateTime=0xca573370, ftLastWriteTime.dwHighDateTime=0x1d4ca94, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="NmYHleAHvhFUD", cAlternateFileName="NMYHLE~1")) returned 1 [0042.242] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.242] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.242] CryptHashData (hHash=0x5c8fc0, pbData=0x33e09d8, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.242] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.242] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.242] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0770*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e0770, pdwDataLen=0x18f678) returned 0 [0042.242] GetLastError () returned 0xea [0042.242] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0770*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e0770*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.243] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NmYHleAHvhFUD\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nmyhleahvhfud\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.243] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.244] SetEndOfFile (hFile=0xf8) returned 1 [0042.244] CloseHandle (hObject=0xf8) returned 1 [0042.244] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.244] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.244] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NmYHleAHvhFUD\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfb89d60, ftCreationTime.dwHighDateTime=0x1d4d513, ftLastAccessTime.dwLowDateTime=0xa9aad450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9aad450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.244] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfb89d60, ftCreationTime.dwHighDateTime=0x1d4d513, ftLastAccessTime.dwLowDateTime=0xa9aad450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9aad450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.244] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8519bca0, ftCreationTime.dwHighDateTime=0x1d4d422, ftLastAccessTime.dwLowDateTime=0x8eb4a580, ftLastAccessTime.dwHighDateTime=0x1d4c758, ftLastWriteTime.dwLowDateTime=0x8eb4a580, ftLastWriteTime.dwHighDateTime=0x1d4c758, nFileSizeHigh=0x0, nFileSizeLow=0x1550d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="63lPZq3SNnHAORv23yF.flv", cAlternateFileName="63LPZQ~1.FLV")) returned 1 [0042.244] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe208ea10, ftCreationTime.dwHighDateTime=0x1d4cff1, ftLastAccessTime.dwLowDateTime=0x2e6c5670, ftLastAccessTime.dwHighDateTime=0x1d4c6b1, ftLastWriteTime.dwLowDateTime=0x2e6c5670, ftLastWriteTime.dwHighDateTime=0x1d4c6b1, nFileSizeHigh=0x0, nFileSizeLow=0x1c77, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="6AMH.mkv", cAlternateFileName="")) returned 1 [0042.244] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5343870, ftCreationTime.dwHighDateTime=0x1d4c574, ftLastAccessTime.dwLowDateTime=0x54f04540, ftLastAccessTime.dwHighDateTime=0x1d4cba2, ftLastWriteTime.dwLowDateTime=0x54f04540, ftLastWriteTime.dwHighDateTime=0x1d4cba2, nFileSizeHigh=0x0, nFileSizeLow=0xf4c5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="B77Jv1PcIX8nKuV-.mkv", cAlternateFileName="B77JV1~1.MKV")) returned 1 [0042.244] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc33420, ftCreationTime.dwHighDateTime=0x1d4cb64, ftLastAccessTime.dwLowDateTime=0x6c0a4860, ftLastAccessTime.dwHighDateTime=0x1d4d373, ftLastWriteTime.dwLowDateTime=0x6c0a4860, ftLastWriteTime.dwHighDateTime=0x1d4d373, nFileSizeHigh=0x0, nFileSizeLow=0x13831, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ePlCEO.mp4", cAlternateFileName="")) returned 1 [0042.244] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9aad450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9aad450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9aad450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.244] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b87e200, ftCreationTime.dwHighDateTime=0x1d4d3fb, ftLastAccessTime.dwLowDateTime=0x7ccada00, ftLastAccessTime.dwHighDateTime=0x1d4cf4c, ftLastWriteTime.dwLowDateTime=0x7ccada00, ftLastWriteTime.dwHighDateTime=0x1d4cf4c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LuoppkTQnaUtW", cAlternateFileName="LUOPPK~1")) returned 1 [0042.244] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.245] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.245] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.245] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f80) returned 1 [0042.245] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.245] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e10e4*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e10e4, pdwDataLen=0x18f410) returned 0 [0042.245] GetLastError () returned 0xea [0042.245] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e10e4*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e10e4*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.245] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NmYHleAHvhFUD\\LuoppkTQnaUtW\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nmyhleahvhfud\\luoppktqnautw\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.246] WriteFile (in: hFile=0xec, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.247] SetEndOfFile (hFile=0xec) returned 1 [0042.247] CloseHandle (hObject=0xec) returned 1 [0042.247] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.247] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.247] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NmYHleAHvhFUD\\LuoppkTQnaUtW\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b87e200, ftCreationTime.dwHighDateTime=0x1d4d3fb, ftLastAccessTime.dwLowDateTime=0xa9aad450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9aad450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.247] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b87e200, ftCreationTime.dwHighDateTime=0x1d4d3fb, ftLastAccessTime.dwLowDateTime=0xa9aad450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9aad450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.247] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x292ac430, ftCreationTime.dwHighDateTime=0x1d4c657, ftLastAccessTime.dwLowDateTime=0x25593e80, ftLastAccessTime.dwHighDateTime=0x1d4cd15, ftLastWriteTime.dwLowDateTime=0x25593e80, ftLastWriteTime.dwHighDateTime=0x1d4cd15, nFileSizeHigh=0x0, nFileSizeLow=0x11d08, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0YtuiGGy9hlr4Bel.avi", cAlternateFileName="0YTUIG~1.AVI")) returned 1 [0042.247] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20a19800, ftCreationTime.dwHighDateTime=0x1d4d135, ftLastAccessTime.dwLowDateTime=0x8b0f35d0, ftLastAccessTime.dwHighDateTime=0x1d4c7a8, ftLastWriteTime.dwLowDateTime=0x8b0f35d0, ftLastWriteTime.dwHighDateTime=0x1d4c7a8, nFileSizeHigh=0x0, nFileSizeLow=0x8fb6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="afw5eefl4k46YWSl0 I.mp4", cAlternateFileName="AFW5EE~1.MP4")) returned 1 [0042.247] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10722c50, ftCreationTime.dwHighDateTime=0x1d4d3bb, ftLastAccessTime.dwLowDateTime=0x3865fff0, ftLastAccessTime.dwHighDateTime=0x1d4d4a8, ftLastWriteTime.dwLowDateTime=0x3865fff0, ftLastWriteTime.dwHighDateTime=0x1d4d4a8, nFileSizeHigh=0x0, nFileSizeLow=0xfe69, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="az4V-dErc0oSCJc_JEsu.avi", cAlternateFileName="AZ4V-D~1.AVI")) returned 1 [0042.247] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x488c4f10, ftCreationTime.dwHighDateTime=0x1d4ccec, ftLastAccessTime.dwLowDateTime=0x15125e80, ftLastAccessTime.dwHighDateTime=0x1d4d2a1, ftLastWriteTime.dwLowDateTime=0x15125e80, ftLastWriteTime.dwHighDateTime=0x1d4d2a1, nFileSizeHigh=0x0, nFileSizeLow=0x11178, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="clzlnKg2DDD.mkv", cAlternateFileName="CLZLNK~1.MKV")) returned 1 [0042.247] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9aad450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9aad450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9aad450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.247] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda4a8d30, ftCreationTime.dwHighDateTime=0x1d4d2a6, ftLastAccessTime.dwLowDateTime=0xd3f424c0, ftLastAccessTime.dwHighDateTime=0x1d4c6b5, ftLastWriteTime.dwLowDateTime=0xd3f424c0, ftLastWriteTime.dwHighDateTime=0x1d4c6b5, nFileSizeHigh=0x0, nFileSizeLow=0xdede, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PVcYf9.flv", cAlternateFileName="")) returned 1 [0042.247] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x358248e0, ftCreationTime.dwHighDateTime=0x1d4c8df, ftLastAccessTime.dwLowDateTime=0x9a8d2f40, ftLastAccessTime.dwHighDateTime=0x1d4c6f8, ftLastWriteTime.dwLowDateTime=0x9a8d2f40, ftLastWriteTime.dwHighDateTime=0x1d4c6f8, nFileSizeHigh=0x0, nFileSizeLow=0x1279f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ur1x3_10TLgwqBBy.flv", cAlternateFileName="UR1X3_~1.FLV")) returned 1 [0042.247] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x358248e0, ftCreationTime.dwHighDateTime=0x1d4c8df, ftLastAccessTime.dwLowDateTime=0x9a8d2f40, ftLastAccessTime.dwHighDateTime=0x1d4c6f8, ftLastWriteTime.dwLowDateTime=0x9a8d2f40, ftLastWriteTime.dwHighDateTime=0x1d4c6f8, nFileSizeHigh=0x0, nFileSizeLow=0x1279f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ur1x3_10TLgwqBBy.flv", cAlternateFileName="UR1X3_~1.FLV")) returned 0 [0042.247] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.247] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27a05ee0, ftCreationTime.dwHighDateTime=0x1d4d3e5, ftLastAccessTime.dwLowDateTime=0xfbc5d730, ftLastAccessTime.dwHighDateTime=0x1d4d594, ftLastWriteTime.dwLowDateTime=0xfbc5d730, ftLastWriteTime.dwHighDateTime=0x1d4d594, nFileSizeHigh=0x0, nFileSizeLow=0xb7c9, dwReserved0=0x42427177, dwReserved1=0x6c662e79, cFileName="R4zvrcR.swf", cAlternateFileName="")) returned 1 [0042.247] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e767df0, ftCreationTime.dwHighDateTime=0x1d4d5a4, ftLastAccessTime.dwLowDateTime=0x1114ca90, ftLastAccessTime.dwHighDateTime=0x1d4cefd, ftLastWriteTime.dwLowDateTime=0x1114ca90, ftLastWriteTime.dwHighDateTime=0x1d4cefd, nFileSizeHigh=0x0, nFileSizeLow=0x49c3, dwReserved0=0x42427177, dwReserved1=0x6c662e79, cFileName="RrY6.mkv", cAlternateFileName="")) returned 1 [0042.247] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bca9a10, ftCreationTime.dwHighDateTime=0x1d4c5fb, ftLastAccessTime.dwLowDateTime=0x886c3e40, ftLastAccessTime.dwHighDateTime=0x1d4ced8, ftLastWriteTime.dwLowDateTime=0x886c3e40, ftLastWriteTime.dwHighDateTime=0x1d4ced8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42427177, dwReserved1=0x6c662e79, cFileName="v4noN7O sKB", cAlternateFileName="V4NON7~1")) returned 1 [0042.247] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.248] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.248] CryptHashData (hHash=0x5c8f80, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.248] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8fc0) returned 1 [0042.248] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.248] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1770*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e1770, pdwDataLen=0x18f410) returned 0 [0042.248] GetLastError () returned 0xea [0042.248] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1770*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1770*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.248] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NmYHleAHvhFUD\\v4noN7O sKB\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nmyhleahvhfud\\v4non7o skb\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.249] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.250] SetEndOfFile (hFile=0xec) returned 1 [0042.250] CloseHandle (hObject=0xec) returned 1 [0042.250] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.250] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.250] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NmYHleAHvhFUD\\v4noN7O sKB\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bca9a10, ftCreationTime.dwHighDateTime=0x1d4c5fb, ftLastAccessTime.dwLowDateTime=0xa9aad450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9aad450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.250] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6bca9a10, ftCreationTime.dwHighDateTime=0x1d4c5fb, ftLastAccessTime.dwLowDateTime=0xa9aad450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9aad450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.250] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8b5f4a0, ftCreationTime.dwHighDateTime=0x1d4d210, ftLastAccessTime.dwLowDateTime=0x4853b8f0, ftLastAccessTime.dwHighDateTime=0x1d4d0c8, ftLastWriteTime.dwLowDateTime=0x4853b8f0, ftLastWriteTime.dwHighDateTime=0x1d4d0c8, nFileSizeHigh=0x0, nFileSizeLow=0x11d95, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="0hBeYEF7Ft4.mkv", cAlternateFileName="0HBEYE~1.MKV")) returned 1 [0042.250] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c6ebb0, ftCreationTime.dwHighDateTime=0x1d4cf98, ftLastAccessTime.dwLowDateTime=0x30197de0, ftLastAccessTime.dwHighDateTime=0x1d4d36d, ftLastWriteTime.dwLowDateTime=0x30197de0, ftLastWriteTime.dwHighDateTime=0x1d4d36d, nFileSizeHigh=0x0, nFileSizeLow=0xcb21, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="A-tY9u0qwXoK.swf", cAlternateFileName="A-TY9U~1.SWF")) returned 1 [0042.250] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x951bae40, ftCreationTime.dwHighDateTime=0x1d4c85d, ftLastAccessTime.dwLowDateTime=0x81a3c550, ftLastAccessTime.dwHighDateTime=0x1d4d299, ftLastWriteTime.dwLowDateTime=0x81a3c550, ftLastWriteTime.dwHighDateTime=0x1d4d299, nFileSizeHigh=0x0, nFileSizeLow=0x17fe7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="EwTuPJmGFKvFjN3.mp4", cAlternateFileName="EWTUPJ~1.MP4")) returned 1 [0042.250] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9aad450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9aad450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9aad450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.250] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5b0a30, ftCreationTime.dwHighDateTime=0x1d4c6b3, ftLastAccessTime.dwLowDateTime=0xf619bcc0, ftLastAccessTime.dwHighDateTime=0x1d4c667, ftLastWriteTime.dwLowDateTime=0xf619bcc0, ftLastWriteTime.dwHighDateTime=0x1d4c667, nFileSizeHigh=0x0, nFileSizeLow=0xb4d7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="jqW0-oJ-hD7GVCfIZGQ.mkv", cAlternateFileName="JQW0-O~1.MKV")) returned 1 [0042.250] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd02cf0, ftCreationTime.dwHighDateTime=0x1d4d25e, ftLastAccessTime.dwLowDateTime=0xd39cfb00, ftLastAccessTime.dwHighDateTime=0x1d4ccbe, ftLastWriteTime.dwLowDateTime=0xd39cfb00, ftLastWriteTime.dwHighDateTime=0x1d4ccbe, nFileSizeHigh=0x0, nFileSizeLow=0x6cc3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="qGllBRYcOUgkbMkyQC9n.flv", cAlternateFileName="QGLLBR~1.FLV")) returned 1 [0042.250] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2abb120, ftCreationTime.dwHighDateTime=0x1d4c972, ftLastAccessTime.dwLowDateTime=0xaa4a2740, ftLastAccessTime.dwHighDateTime=0x1d4ce7c, ftLastWriteTime.dwLowDateTime=0xaa4a2740, ftLastWriteTime.dwHighDateTime=0x1d4ce7c, nFileSizeHigh=0x0, nFileSizeLow=0x9781, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="UMyE-gB aFi11e3K.swf", cAlternateFileName="UMYE-G~1.SWF")) returned 1 [0042.251] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2abb120, ftCreationTime.dwHighDateTime=0x1d4c972, ftLastAccessTime.dwLowDateTime=0xaa4a2740, ftLastAccessTime.dwHighDateTime=0x1d4ce7c, ftLastWriteTime.dwLowDateTime=0xaa4a2740, ftLastWriteTime.dwHighDateTime=0x1d4ce7c, nFileSizeHigh=0x0, nFileSizeLow=0x9781, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="UMyE-gB aFi11e3K.swf", cAlternateFileName="UMYE-G~1.SWF")) returned 0 [0042.251] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.251] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc4cbe0, ftCreationTime.dwHighDateTime=0x1d4c65f, ftLastAccessTime.dwLowDateTime=0xec2b05d0, ftLastAccessTime.dwHighDateTime=0x1d4d2f5, ftLastWriteTime.dwLowDateTime=0xec2b05d0, ftLastWriteTime.dwHighDateTime=0x1d4d2f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x33653131, dwReserved1=0x77732e4b, cFileName="vd8DgU1S", cAlternateFileName="")) returned 1 [0042.251] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.251] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.251] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.251] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f80) returned 1 [0042.251] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.251] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1db4*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e1db4, pdwDataLen=0x18f410) returned 0 [0042.251] GetLastError () returned 0xea [0042.251] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1db4*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1db4*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.252] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NmYHleAHvhFUD\\vd8DgU1S\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nmyhleahvhfud\\vd8dgu1s\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.252] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.253] SetEndOfFile (hFile=0xec) returned 1 [0042.253] CloseHandle (hObject=0xec) returned 1 [0042.253] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.253] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.253] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NmYHleAHvhFUD\\vd8DgU1S\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc4cbe0, ftCreationTime.dwHighDateTime=0x1d4c65f, ftLastAccessTime.dwLowDateTime=0xa9aad450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9aad450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.253] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc4cbe0, ftCreationTime.dwHighDateTime=0x1d4c65f, ftLastAccessTime.dwLowDateTime=0xa9aad450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9aad450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.253] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f723710, ftCreationTime.dwHighDateTime=0x1d4c70d, ftLastAccessTime.dwLowDateTime=0xe2684b70, ftLastAccessTime.dwHighDateTime=0x1d4c71a, ftLastWriteTime.dwLowDateTime=0xe2684b70, ftLastWriteTime.dwHighDateTime=0x1d4c71a, nFileSizeHigh=0x0, nFileSizeLow=0xec08, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="av6EJhj6daw.flv", cAlternateFileName="AV6EJH~1.FLV")) returned 1 [0042.253] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb11d7570, ftCreationTime.dwHighDateTime=0x1d4c5b4, ftLastAccessTime.dwLowDateTime=0x2611f2f0, ftLastAccessTime.dwHighDateTime=0x1d4cc1f, ftLastWriteTime.dwLowDateTime=0x2611f2f0, ftLastWriteTime.dwHighDateTime=0x1d4cc1f, nFileSizeHigh=0x0, nFileSizeLow=0xd7b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="D0wCnD.swf", cAlternateFileName="")) returned 1 [0042.253] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9aad450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9aad450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9aad450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.253] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43d9b670, ftCreationTime.dwHighDateTime=0x1d4cbce, ftLastAccessTime.dwLowDateTime=0x98c73160, ftLastAccessTime.dwHighDateTime=0x1d4d071, ftLastWriteTime.dwLowDateTime=0x98c73160, ftLastWriteTime.dwHighDateTime=0x1d4d071, nFileSizeHigh=0x0, nFileSizeLow=0x17e70, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="kGd4Dp.flv", cAlternateFileName="")) returned 1 [0042.253] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4174ae50, ftCreationTime.dwHighDateTime=0x1d4cb13, ftLastAccessTime.dwLowDateTime=0xcf29e270, ftLastAccessTime.dwHighDateTime=0x1d4d1ed, ftLastWriteTime.dwLowDateTime=0xcf29e270, ftLastWriteTime.dwHighDateTime=0x1d4d1ed, nFileSizeHigh=0x0, nFileSizeLow=0xbc70, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ne QWZ6OS1v.mp4", cAlternateFileName="NEQWZ6~1.MP4")) returned 1 [0042.253] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30597300, ftCreationTime.dwHighDateTime=0x1d4c549, ftLastAccessTime.dwLowDateTime=0xb80fc790, ftLastAccessTime.dwHighDateTime=0x1d4c814, ftLastWriteTime.dwLowDateTime=0xb80fc790, ftLastWriteTime.dwHighDateTime=0x1d4c814, nFileSizeHigh=0x0, nFileSizeLow=0xee0c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="YVs8isf1eAN_oRcfI.mkv", cAlternateFileName="YVS8IS~1.MKV")) returned 1 [0042.254] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30597300, ftCreationTime.dwHighDateTime=0x1d4c549, ftLastAccessTime.dwLowDateTime=0xb80fc790, ftLastAccessTime.dwHighDateTime=0x1d4c814, ftLastWriteTime.dwLowDateTime=0xb80fc790, ftLastWriteTime.dwHighDateTime=0x1d4c814, nFileSizeHigh=0x0, nFileSizeLow=0xee0c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="YVs8isf1eAN_oRcfI.mkv", cAlternateFileName="YVS8IS~1.MKV")) returned 0 [0042.254] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.254] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d54e100, ftCreationTime.dwHighDateTime=0x1d4c777, ftLastAccessTime.dwLowDateTime=0xfd292a00, ftLastAccessTime.dwHighDateTime=0x1d4d0ad, ftLastWriteTime.dwLowDateTime=0xfd292a00, ftLastWriteTime.dwHighDateTime=0x1d4d0ad, nFileSizeHigh=0x0, nFileSizeLow=0xa378, dwReserved0=0x63526f5f, dwReserved1=0x6d2e4966, cFileName="X6AykOL2FK2Lb5zKk.swf", cAlternateFileName="X6AYKO~1.SWF")) returned 1 [0042.254] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d54e100, ftCreationTime.dwHighDateTime=0x1d4c777, ftLastAccessTime.dwLowDateTime=0xfd292a00, ftLastAccessTime.dwHighDateTime=0x1d4d0ad, ftLastWriteTime.dwLowDateTime=0xfd292a00, ftLastWriteTime.dwHighDateTime=0x1d4d0ad, nFileSizeHigh=0x0, nFileSizeLow=0xa378, dwReserved0=0x63526f5f, dwReserved1=0x6d2e4966, cFileName="X6AykOL2FK2Lb5zKk.swf", cAlternateFileName="X6AYKO~1.SWF")) returned 0 [0042.254] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.254] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2958abd0, ftCreationTime.dwHighDateTime=0x1d4c674, ftLastAccessTime.dwLowDateTime=0x40536070, ftLastAccessTime.dwHighDateTime=0x1d4cfa0, ftLastWriteTime.dwLowDateTime=0x40536070, ftLastWriteTime.dwHighDateTime=0x1d4cfa0, nFileSizeHigh=0x0, nFileSizeLow=0x16c0b, dwReserved0=0x7a35624c, dwReserved1=0x732e6b4b, cFileName="NvfRbKM-Q.flv", cAlternateFileName="NVFRBK~1.FLV")) returned 1 [0042.254] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d994790, ftCreationTime.dwHighDateTime=0x1d4d18a, ftLastAccessTime.dwLowDateTime=0xb6c12d40, ftLastAccessTime.dwHighDateTime=0x1d4cd53, ftLastWriteTime.dwLowDateTime=0xb6c12d40, ftLastWriteTime.dwHighDateTime=0x1d4cd53, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a35624c, dwReserved1=0x732e6b4b, cFileName="O4Yqd", cAlternateFileName="")) returned 1 [0042.254] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.254] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.254] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.254] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f80) returned 1 [0042.254] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.254] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1d9c*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e1d9c, pdwDataLen=0x18f678) returned 0 [0042.254] GetLastError () returned 0xea [0042.255] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1d9c*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e1d9c*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.255] CreateFileA (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\O4Yqd\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\o4yqd\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.255] WriteFile (in: hFile=0xf8, lpBuffer=0x33e0b1c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33e0b1c*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.256] SetEndOfFile (hFile=0xf8) returned 1 [0042.256] CloseHandle (hObject=0xf8) returned 1 [0042.256] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.256] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.256] FindFirstFileA (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\O4Yqd\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d994790, ftCreationTime.dwHighDateTime=0x1d4d18a, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.256] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d994790, ftCreationTime.dwHighDateTime=0x1d4d18a, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.256] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9ad35b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.256] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e92b470, ftCreationTime.dwHighDateTime=0x1d4cea5, ftLastAccessTime.dwLowDateTime=0xfd61fd60, ftLastAccessTime.dwHighDateTime=0x1d4d0e6, ftLastWriteTime.dwLowDateTime=0xfd61fd60, ftLastWriteTime.dwHighDateTime=0x1d4d0e6, nFileSizeHigh=0x0, nFileSizeLow=0x18d26, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="t6Ybl35E-1WGC.mkv", cAlternateFileName="T6YBL3~1.MKV")) returned 1 [0042.256] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e92b470, ftCreationTime.dwHighDateTime=0x1d4cea5, ftLastAccessTime.dwLowDateTime=0xfd61fd60, ftLastAccessTime.dwHighDateTime=0x1d4d0e6, ftLastWriteTime.dwLowDateTime=0xfd61fd60, ftLastWriteTime.dwHighDateTime=0x1d4d0e6, nFileSizeHigh=0x0, nFileSizeLow=0x18d26, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="t6Ybl35E-1WGC.mkv", cAlternateFileName="T6YBL3~1.MKV")) returned 0 [0042.257] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.257] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14deacb0, ftCreationTime.dwHighDateTime=0x1d4cdb1, ftLastAccessTime.dwLowDateTime=0x60e246a0, ftLastAccessTime.dwHighDateTime=0x1d4d075, ftLastWriteTime.dwLowDateTime=0x60e246a0, ftLastWriteTime.dwHighDateTime=0x1d4d075, nFileSizeHigh=0x0, nFileSizeLow=0x1e28, dwReserved0=0x6d2e4347, dwReserved1=0x5243766b, cFileName="Pj1QWg6ByW-.swf", cAlternateFileName="PJ1QWG~1.SWF")) returned 1 [0042.257] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce26c6a0, ftCreationTime.dwHighDateTime=0x1d4c6f2, ftLastAccessTime.dwLowDateTime=0x5d1e0790, ftLastAccessTime.dwHighDateTime=0x1d4c641, ftLastWriteTime.dwLowDateTime=0x5d1e0790, ftLastWriteTime.dwHighDateTime=0x1d4c641, nFileSizeHigh=0x0, nFileSizeLow=0x18f86, dwReserved0=0x6d2e4347, dwReserved1=0x5243766b, cFileName="PxAgTEg2m.swf", cAlternateFileName="PXAGTE~1.SWF")) returned 1 [0042.257] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b7a2670, ftCreationTime.dwHighDateTime=0x1d4ce07, ftLastAccessTime.dwLowDateTime=0x79458340, ftLastAccessTime.dwHighDateTime=0x1d4c9fb, ftLastWriteTime.dwLowDateTime=0x79458340, ftLastWriteTime.dwHighDateTime=0x1d4c9fb, nFileSizeHigh=0x0, nFileSizeLow=0xcaf8, dwReserved0=0x6d2e4347, dwReserved1=0x5243766b, cFileName="QvXt.mkv", cAlternateFileName="")) returned 1 [0042.257] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b92aec0, ftCreationTime.dwHighDateTime=0x1d4ce40, ftLastAccessTime.dwLowDateTime=0xf2ca45c0, ftLastAccessTime.dwHighDateTime=0x1d4ce8d, ftLastWriteTime.dwLowDateTime=0xf2ca45c0, ftLastWriteTime.dwHighDateTime=0x1d4ce8d, nFileSizeHigh=0x0, nFileSizeLow=0x49a3, dwReserved0=0x6d2e4347, dwReserved1=0x5243766b, cFileName="rgIcyANdL2Redj9.flv", cAlternateFileName="RGICYA~1.FLV")) returned 1 [0042.257] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9469e60, ftCreationTime.dwHighDateTime=0x1d4c9df, ftLastAccessTime.dwLowDateTime=0x18703f70, ftLastAccessTime.dwHighDateTime=0x1d4c680, ftLastWriteTime.dwLowDateTime=0x18703f70, ftLastWriteTime.dwHighDateTime=0x1d4c680, nFileSizeHigh=0x0, nFileSizeLow=0x130aa, dwReserved0=0x6d2e4347, dwReserved1=0x5243766b, cFileName="yeAdMsBU85fIkLbN.mp4", cAlternateFileName="YEADMS~1.MP4")) returned 1 [0042.257] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9469e60, ftCreationTime.dwHighDateTime=0x1d4c9df, ftLastAccessTime.dwLowDateTime=0x18703f70, ftLastAccessTime.dwHighDateTime=0x1d4c680, ftLastWriteTime.dwLowDateTime=0x18703f70, ftLastWriteTime.dwHighDateTime=0x1d4c680, nFileSizeHigh=0x0, nFileSizeLow=0x130aa, dwReserved0=0x6d2e4347, dwReserved1=0x5243766b, cFileName="yeAdMsBU85fIkLbN.mp4", cAlternateFileName="YEADMS~1.MP4")) returned 0 [0042.257] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0042.257] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa58eb490, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa58eb490, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="Videos", cAlternateFileName="")) returned 0 [0042.257] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.257] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x64623874, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0042.257] CryptAcquireContextA (in: phProv=0x18fb3c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18fb3c*=0x5d0e80) returned 1 [0042.258] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18faf4 | out: phHash=0x18faf4) returned 1 [0042.258] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.258] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18fb38 | out: phKey=0x18fb38*=0x5c9140) returned 1 [0042.258] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.258] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0b24*, pdwDataLen=0x18fb48*=0x258, dwBufLen=0x258 | out: pbData=0x33e0b24, pdwDataLen=0x18fb48) returned 0 [0042.258] GetLastError () returned 0xea [0042.258] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0b24*, pdwDataLen=0x18fb44*=0x258, dwBufLen=0x260 | out: pbData=0x33e0b24*, pdwDataLen=0x18fb44*=0x260) returned 1 [0042.258] CreateFileA (lpFileName="C:\\Users\\All Users\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0042.258] WriteFile (in: hFile=0xf4, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f8c8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f8c8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.259] SetEndOfFile (hFile=0xf4) returned 1 [0042.259] CloseHandle (hObject=0xf4) returned 1 [0042.259] CryptDestroyKey (hKey=0x5c9140) returned 1 [0042.259] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.259] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0042.259] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.260] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Adobe", cAlternateFileName="")) returned 1 [0042.260] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.260] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.260] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.260] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8f80) returned 1 [0042.260] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.260] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1100*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1100, pdwDataLen=0x18f8e0) returned 0 [0042.260] GetLastError () returned 0xea [0042.260] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1100*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1100*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.261] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\adobe\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.261] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.262] SetEndOfFile (hFile=0xdc) returned 1 [0042.262] CloseHandle (hObject=0xdc) returned 1 [0042.262] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.262] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.262] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.262] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.262] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0042.262] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.263] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.263] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.263] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.263] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.263] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2fb4*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2fb4, pdwDataLen=0x18f678) returned 0 [0042.263] GetLastError () returned 0xea [0042.263] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2fb4*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2fb4*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.263] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\adobe\\acrobat\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.264] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.264] SetEndOfFile (hFile=0xf8) returned 1 [0042.265] CloseHandle (hObject=0xf8) returned 1 [0042.265] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.265] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.265] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.266] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.266] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="10.0", cAlternateFileName="")) returned 1 [0042.266] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.266] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.266] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.266] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8fc0) returned 1 [0042.266] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.266] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f8c*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2f8c, pdwDataLen=0x18f410) returned 0 [0042.266] GetLastError () returned 0xea [0042.266] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f8c*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2f8c*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.267] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.267] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.268] SetEndOfFile (hFile=0xec) returned 1 [0042.268] CloseHandle (hObject=0xec) returned 1 [0042.268] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.268] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.268] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.268] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.269] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ad35b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.269] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 1 [0042.269] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.271] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.271] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.271] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0042.271] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.271] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f8c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2f8c, pdwDataLen=0x18f1a8) returned 0 [0042.271] GetLastError () returned 0xea [0042.271] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f8c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2f8c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.271] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.272] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.273] SetEndOfFile (hFile=0xe8) returned 1 [0042.273] CloseHandle (hObject=0xe8) returned 1 [0042.273] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.273] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.273] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.273] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.273] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9af9710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.273] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Security", cAlternateFileName="")) returned 1 [0042.273] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.274] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.274] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.274] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9040) returned 1 [0042.274] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.274] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f8c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2f8c, pdwDataLen=0x18ef40) returned 0 [0042.274] GetLastError () returned 0xea [0042.274] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f8c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2f8c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.274] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.275] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.276] SetEndOfFile (hFile=0xf0) returned 1 [0042.276] CloseHandle (hObject=0xf0) returned 1 [0042.278] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.278] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.278] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.278] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.278] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 1 [0042.278] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9af9710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.278] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9af9710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.278] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.278] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Security", cAlternateFileName="")) returned 0 [0042.278] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.279] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 0 [0042.279] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.279] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ad35b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.279] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ad35b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.279] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.279] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="ARM", cAlternateFileName="")) returned 1 [0042.279] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.279] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.279] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.279] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8fc0) returned 1 [0042.279] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.279] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f8c*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2f8c, pdwDataLen=0x18f678) returned 0 [0042.279] GetLastError () returned 0xea [0042.280] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f8c*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2f8c*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.280] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\adobe\\arm\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.280] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.281] SetEndOfFile (hFile=0xf8) returned 1 [0042.281] CloseHandle (hObject=0xf8) returned 1 [0042.281] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.281] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.281] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.281] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.281] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9af9710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.281] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 1 [0042.281] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.282] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.282] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.282] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8ec0) returned 1 [0042.282] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.282] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f8c*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2f8c, pdwDataLen=0x18f410) returned 0 [0042.282] GetLastError () returned 0xea [0042.282] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f8c*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2f8c*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.282] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.283] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.284] SetEndOfFile (hFile=0xec) returned 1 [0042.285] CloseHandle (hObject=0xec) returned 1 [0042.285] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.285] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.285] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.285] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.285] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 1 [0042.285] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 1 [0042.285] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 1 [0042.285] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9af9710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.285] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9af9710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9af9710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9af9710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.285] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.285] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 0 [0042.285] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.285] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ad35b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045302e, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.285] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ad35b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045302e, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.285] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.285] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52434e45, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0042.285] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.286] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.286] CryptHashData (hHash=0x5c8f80, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.286] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8fc0) returned 1 [0042.286] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.286] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f64*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2f64, pdwDataLen=0x18f8e0) returned 0 [0042.286] GetLastError () returned 0xea [0042.286] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f64*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2f64*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.286] CreateFileA (lpFileName="C:\\Users\\All Users\\Application Data\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\application data\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.286] WriteFile (in: hFile=0xdc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.286] SetEndOfFile (hFile=0xdc) returned 1 [0042.287] CloseHandle (hObject=0xdc) returned 1 [0042.287] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.287] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.287] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Application Data\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x91\\")) returned 0xffffffff [0042.287] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x183, cFileName="Desktop", cAlternateFileName="")) returned 1 [0042.287] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.287] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.287] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.287] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8f80) returned 1 [0042.287] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.288] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f8e0) returned 0 [0042.288] GetLastError () returned 0xea [0042.288] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.288] CreateFileA (lpFileName="C:\\Users\\All Users\\Desktop\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\desktop\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.288] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.289] SetEndOfFile (hFile=0xdc) returned 1 [0042.289] CloseHandle (hObject=0xdc) returned 1 [0042.290] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.290] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.290] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Desktop\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x91\\")) returned 0xffffffff [0042.290] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x183, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0042.290] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.290] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.290] CryptHashData (hHash=0x5c8f80, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.290] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8fc0) returned 1 [0042.290] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.290] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f8e0) returned 0 [0042.290] GetLastError () returned 0xea [0042.290] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.291] CreateFileA (lpFileName="C:\\Users\\All Users\\Documents\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\documents\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.291] WriteFile (in: hFile=0xdc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.292] SetEndOfFile (hFile=0xdc) returned 1 [0042.292] CloseHandle (hObject=0xdc) returned 1 [0042.292] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.292] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.292] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Documents\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x91\\")) returned 0xffffffff [0042.292] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x183, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0042.292] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.293] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.293] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.293] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8f80) returned 1 [0042.293] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.293] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f8e0) returned 0 [0042.293] GetLastError () returned 0xea [0042.293] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.293] CreateFileA (lpFileName="C:\\Users\\All Users\\Favorites\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\favorites\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.294] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.295] SetEndOfFile (hFile=0xdc) returned 1 [0042.295] CloseHandle (hObject=0xdc) returned 1 [0042.295] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.295] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.295] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Favorites\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x91\\")) returned 0xffffffff [0042.295] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ad35b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ad35b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ad35b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x3, dwReserved1=0x183, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.295] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x183, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0042.295] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.296] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.296] CryptHashData (hHash=0x5c8f80, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.296] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8fc0) returned 1 [0042.296] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.296] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f8e0) returned 0 [0042.296] GetLastError () returned 0xea [0042.296] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.296] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.297] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.298] SetEndOfFile (hFile=0xdc) returned 1 [0042.298] CloseHandle (hObject=0xdc) returned 1 [0042.298] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.298] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.298] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.298] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.298] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1 [0042.298] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.299] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.299] CryptHashData (hHash=0x5c8f80, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.299] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8ec0) returned 1 [0042.299] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.299] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.299] GetLastError () returned 0xea [0042.299] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.299] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\assistance\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.299] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.300] SetEndOfFile (hFile=0xf8) returned 1 [0042.300] CloseHandle (hObject=0xf8) returned 1 [0042.300] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.300] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.300] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.301] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.301] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Client", cAlternateFileName="")) returned 1 [0042.301] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.301] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.302] CryptHashData (hHash=0x5c8f80, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.302] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0042.302] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.302] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.302] GetLastError () returned 0xea [0042.302] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.302] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.302] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.303] SetEndOfFile (hFile=0xec) returned 1 [0042.303] CloseHandle (hObject=0xec) returned 1 [0042.303] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.303] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.303] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.304] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.304] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1.0", cAlternateFileName="")) returned 1 [0042.304] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.304] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.304] CryptHashData (hHash=0x5c8f80, pbData=0x1fe5350, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.304] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0042.304] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.304] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.304] GetLastError () returned 0xea [0042.304] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.305] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.305] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.306] SetEndOfFile (hFile=0xe8) returned 1 [0042.306] CloseHandle (hObject=0xe8) returned 1 [0042.306] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.306] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.306] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.306] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.306] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0042.306] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.307] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.307] CryptHashData (hHash=0x5c8f80, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.307] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f40) returned 1 [0042.307] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.307] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.307] GetLastError () returned 0xea [0042.307] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.307] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.308] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.309] SetEndOfFile (hFile=0xf0) returned 1 [0042.309] CloseHandle (hObject=0xf0) returned 1 [0042.309] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.309] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.309] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.310] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b459d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b459d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.310] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b459d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b459d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.310] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b459d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b459d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.310] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b1f870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b1f870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.310] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.310] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Crypto", cAlternateFileName="")) returned 1 [0042.310] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.311] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.311] CryptHashData (hHash=0x5c8ec0, pbData=0x1fc6440, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.311] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.311] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.311] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.311] GetLastError () returned 0xea [0042.311] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.311] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.312] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.313] SetEndOfFile (hFile=0xf8) returned 1 [0042.313] CloseHandle (hObject=0xf8) returned 1 [0042.313] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.313] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.313] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.313] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.313] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="DSS", cAlternateFileName="")) returned 1 [0042.313] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.314] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.314] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.314] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9040) returned 1 [0042.314] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.314] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.314] GetLastError () returned 0xea [0042.314] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.314] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.315] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.317] SetEndOfFile (hFile=0xec) returned 1 [0042.317] CloseHandle (hObject=0xec) returned 1 [0042.317] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.317] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.317] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.317] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.317] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b459d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.318] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0042.318] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.318] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.318] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.318] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f40) returned 1 [0042.318] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.318] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.318] GetLastError () returned 0xea [0042.318] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.319] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.319] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.320] SetEndOfFile (hFile=0xe8) returned 1 [0042.320] CloseHandle (hObject=0xe8) returned 1 [0042.320] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.320] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.320] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.320] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.320] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b6bb30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.321] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b6bb30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.321] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.321] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0042.321] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.321] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b459d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b459d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b459d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.321] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Keys", cAlternateFileName="")) returned 1 [0042.321] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.321] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.321] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.321] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.321] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.321] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.321] GetLastError () returned 0xea [0042.321] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.322] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.322] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.323] SetEndOfFile (hFile=0xec) returned 1 [0042.323] CloseHandle (hObject=0xec) returned 1 [0042.323] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.323] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.323] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.324] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.324] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b6bb30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.324] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b6bb30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.324] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.324] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="RSA", cAlternateFileName="")) returned 1 [0042.324] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.324] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.324] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.324] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9040) returned 1 [0042.324] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.324] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.324] GetLastError () returned 0xea [0042.324] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.325] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.325] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.326] SetEndOfFile (hFile=0xec) returned 1 [0042.326] CloseHandle (hObject=0xec) returned 1 [0042.326] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.326] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.326] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.326] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.326] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b6bb30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.327] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0042.327] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.327] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.327] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.327] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0042.327] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.327] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.327] GetLastError () returned 0xea [0042.327] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.328] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.328] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.329] SetEndOfFile (hFile=0xe8) returned 1 [0042.329] CloseHandle (hObject=0xe8) returned 1 [0042.329] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.329] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.329] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.329] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.329] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b6bb30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.329] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b6bb30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b6bb30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.329] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.329] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0042.330] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.330] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.330] CryptHashData (hHash=0x5c8ec0, pbData=0x33e1c78, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.330] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f40) returned 1 [0042.330] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.330] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.330] GetLastError () returned 0xea [0042.330] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.331] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.333] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.334] SetEndOfFile (hFile=0xe8) returned 1 [0042.334] CloseHandle (hObject=0xe8) returned 1 [0042.334] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.334] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.334] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.334] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.334] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 1 [0042.334] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 1 [0042.334] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b6bb30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.334] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b6bb30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b6bb30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.334] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.334] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0042.334] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.334] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="RSA", cAlternateFileName="")) returned 0 [0042.335] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.335] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0042.335] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.335] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.335] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.335] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9040) returned 1 [0042.335] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.335] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.335] GetLastError () returned 0xea [0042.335] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.336] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.336] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.337] SetEndOfFile (hFile=0xf8) returned 1 [0042.337] CloseHandle (hObject=0xf8) returned 1 [0042.337] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.337] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.337] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.337] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.337] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Device", cAlternateFileName="")) returned 1 [0042.337] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.338] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.338] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.338] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.338] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.338] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.338] GetLastError () returned 0xea [0042.338] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.338] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.341] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.341] SetEndOfFile (hFile=0xec) returned 1 [0042.342] CloseHandle (hObject=0xec) returned 1 [0042.342] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.342] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.342] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.342] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.342] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b91c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.342] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa59a9b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa59a9b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0042.342] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.342] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.342] CryptHashData (hHash=0x5c90c0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.343] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0042.343] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.343] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.343] GetLastError () returned 0xea [0042.343] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.343] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.343] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.344] SetEndOfFile (hFile=0xe8) returned 1 [0042.344] CloseHandle (hObject=0xe8) returned 1 [0042.344] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.344] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.345] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.345] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.345] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="background.png", cAlternateFileName="")) returned 1 [0042.345] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa595d8b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa595d8b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5983a10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="background.png.crypt", cAlternateFileName="BACKGR~1.CRY")) returned 1 [0042.345] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0042.345] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="device.png", cAlternateFileName="")) returned 1 [0042.345] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5983a10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5983a10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5983a10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="device.png.crypt", cAlternateFileName="DEVICE~1.CRY")) returned 1 [0042.345] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b91c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.345] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0042.345] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5983a10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5983a10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa59a9b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="overlay.png.crypt", cAlternateFileName="OVERLA~1.CRY")) returned 1 [0042.345] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0042.345] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa59a9b70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa59a9b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa59a9b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="superbar.png.crypt", cAlternateFileName="SUPERB~1.CRY")) returned 1 [0042.345] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa59a9b70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa59a9b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa59a9b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="superbar.png.crypt", cAlternateFileName="SUPERB~1.CRY")) returned 0 [0042.345] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.345] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa59cfcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa59cfcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72632e67, dwReserved1=0x52747079, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0042.345] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.346] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.346] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.346] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0042.346] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.346] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.346] GetLastError () returned 0xea [0042.346] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.346] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.346] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.348] SetEndOfFile (hFile=0xe8) returned 1 [0042.348] CloseHandle (hObject=0xe8) returned 1 [0042.348] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.348] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.348] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.348] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.348] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="background.png", cAlternateFileName="")) returned 1 [0042.348] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa59a9b70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa59a9b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa59cfcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="background.png.crypt", cAlternateFileName="BACKGR~1.CRY")) returned 1 [0042.348] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0042.348] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b91c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bb7df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.348] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0042.348] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa59cfcd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa59cfcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa59f5e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="watermark.png.crypt", cAlternateFileName="WATERM~1.CRY")) returned 1 [0042.348] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa59cfcd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa59cfcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa59f5e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="watermark.png.crypt", cAlternateFileName="WATERM~1.CRY")) returned 0 [0042.348] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.348] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa59cfcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa59cfcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72632e67, dwReserved1=0x52747079, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0042.348] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.348] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b91c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b91c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b91c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2d646161, dwReserved1=0x34373634, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.348] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d646161, dwReserved1=0x34373634, cFileName="Task", cAlternateFileName="")) returned 1 [0042.348] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.349] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.349] CryptHashData (hHash=0x5c8f40, pbData=0x33e1c54, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.349] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0042.349] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.349] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.349] GetLastError () returned 0xea [0042.349] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.350] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.351] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.352] SetEndOfFile (hFile=0xec) returned 1 [0042.353] CloseHandle (hObject=0xec) returned 1 [0042.353] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.353] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.353] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9bb7df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bb7df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.353] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9bb7df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bb7df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.353] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9bb7df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9bb7df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bb7df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.353] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0042.353] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.353] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.353] CryptHashData (hHash=0x5c8f40, pbData=0x1fc6440, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.354] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0042.354] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.354] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.354] GetLastError () returned 0xea [0042.354] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.354] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.355] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.356] SetEndOfFile (hFile=0xe8) returned 1 [0042.356] CloseHandle (hObject=0xe8) returned 1 [0042.356] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.356] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.356] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9bb7df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bb7df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.356] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9bb7df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bb7df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.356] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0042.356] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.357] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.357] CryptHashData (hHash=0x5c8f40, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.357] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0042.357] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.357] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.357] GetLastError () returned 0xea [0042.357] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.357] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.358] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.359] SetEndOfFile (hFile=0xf0) returned 1 [0042.359] CloseHandle (hObject=0xf0) returned 1 [0042.359] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.359] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.359] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa9bb7df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bb7df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.359] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa9bb7df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bb7df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.359] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bb7df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9bb7df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bb7df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.359] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0042.359] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0042.359] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.359] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0042.360] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bb7df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9bb7df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bb7df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.360] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0042.360] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0042.360] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0042.360] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0042.360] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0042.360] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0042.360] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0042.360] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0042.360] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0042.360] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.360] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456f6f, dwReserved1=0x52434e45, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0042.360] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.361] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.361] CryptHashData (hHash=0x5c8ec0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.361] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f80) returned 1 [0042.361] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.361] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.361] GetLastError () returned 0xea [0042.361] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.361] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.362] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.363] SetEndOfFile (hFile=0xe8) returned 1 [0042.363] CloseHandle (hObject=0xe8) returned 1 [0042.363] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.363] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.363] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9bb7df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bb7df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.363] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9bb7df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bb7df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.363] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0042.363] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.364] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.364] CryptHashData (hHash=0x5c8ec0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.364] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f40) returned 1 [0042.364] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.364] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.364] GetLastError () returned 0xea [0042.364] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.365] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.365] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.366] SetEndOfFile (hFile=0xf0) returned 1 [0042.366] CloseHandle (hObject=0xf0) returned 1 [0042.366] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.366] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.366] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.366] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.366] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bddf50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.366] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0042.366] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0042.366] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.366] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0042.366] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bb7df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9bb7df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.366] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0042.367] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0042.367] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0042.367] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0042.367] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0042.367] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0042.367] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0042.367] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x2045526c, dwReserved1=0x52434e45, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0042.367] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.367] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456f6f, dwReserved1=0x52434e45, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0042.367] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.367] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d646161, dwReserved1=0x34373634, cFileName="Task", cAlternateFileName="")) returned 0 [0042.367] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.367] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0042.367] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.368] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.368] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.368] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.368] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.368] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.368] GetLastError () returned 0xea [0042.368] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.368] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.369] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.369] SetEndOfFile (hFile=0xf8) returned 1 [0042.370] CloseHandle (hObject=0xf8) returned 1 [0042.370] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.370] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.370] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.370] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.370] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bddf50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.370] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bddf50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.370] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.370] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="DRM", cAlternateFileName="")) returned 1 [0042.370] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.371] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.371] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.371] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9040) returned 1 [0042.371] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.371] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.371] GetLastError () returned 0xea [0042.371] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.371] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\drm\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.372] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.372] SetEndOfFile (hFile=0xf8) returned 1 [0042.373] CloseHandle (hObject=0xf8) returned 1 [0042.373] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.373] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.373] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.373] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.373] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9bddf50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.373] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Server", cAlternateFileName="")) returned 1 [0042.373] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.374] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.374] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.374] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f80) returned 1 [0042.374] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.374] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.374] GetLastError () returned 0xea [0042.374] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.374] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.375] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.375] SetEndOfFile (hFile=0xec) returned 1 [0042.376] CloseHandle (hObject=0xec) returned 1 [0042.376] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.376] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.376] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.376] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.376] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bddf50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.376] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bddf50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.376] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.376] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Server", cAlternateFileName="")) returned 0 [0042.376] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.376] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="eHome", cAlternateFileName="")) returned 1 [0042.376] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.377] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.377] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.377] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f80) returned 1 [0042.377] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.377] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.377] GetLastError () returned 0xea [0042.377] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.377] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\ehome\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.378] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.379] SetEndOfFile (hFile=0xf8) returned 1 [0042.379] CloseHandle (hObject=0xf8) returned 1 [0042.379] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.379] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.379] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.379] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9bddf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.379] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9bddf50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9bddf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.379] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="logs", cAlternateFileName="")) returned 1 [0042.379] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.380] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.380] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.380] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0042.380] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.380] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.380] GetLastError () returned 0xea [0042.380] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.380] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.381] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.382] SetEndOfFile (hFile=0xec) returned 1 [0042.382] CloseHandle (hObject=0xec) returned 1 [0042.382] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.382] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.382] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.382] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.382] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c040b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.382] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c040b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.382] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.382] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="logs", cAlternateFileName="")) returned 0 [0042.382] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.383] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0042.383] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.383] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.383] CryptHashData (hHash=0x5c8f80, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.383] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.383] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.383] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.383] GetLastError () returned 0xea [0042.383] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.384] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.384] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.385] SetEndOfFile (hFile=0xf8) returned 1 [0042.385] CloseHandle (hObject=0xf8) returned 1 [0042.385] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.385] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.385] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c040b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.385] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Views", cAlternateFileName="")) returned 1 [0042.386] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.386] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.386] CryptHashData (hHash=0x5c8f80, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.386] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9040) returned 1 [0042.386] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.386] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.386] GetLastError () returned 0xea [0042.386] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.387] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.387] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.388] SetEndOfFile (hFile=0xec) returned 1 [0042.388] CloseHandle (hObject=0xec) returned 1 [0042.388] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.388] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.388] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.388] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.388] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0042.388] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.389] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.389] CryptHashData (hHash=0x5c8f80, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.389] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f40) returned 1 [0042.389] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.389] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.389] GetLastError () returned 0xea [0042.389] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.389] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.390] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.391] SetEndOfFile (hFile=0xe8) returned 1 [0042.391] CloseHandle (hObject=0xe8) returned 1 [0042.391] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.391] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.391] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.391] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.391] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c040b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.391] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c040b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.391] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.391] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c040b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.391] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c040b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c040b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.391] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.391] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Views", cAlternateFileName="")) returned 0 [0042.391] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.392] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9b1f870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.392] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0042.392] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.392] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.392] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.392] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9040) returned 1 [0042.392] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.392] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.392] GetLastError () returned 0xea [0042.392] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.393] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.396] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.397] SetEndOfFile (hFile=0xf8) returned 1 [0042.397] CloseHandle (hObject=0xf8) returned 1 [0042.397] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.397] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.397] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.398] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.398] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c040b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c040b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.398] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0042.398] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1 [0042.398] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0042.398] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.398] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x52434e45, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0042.398] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.398] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.398] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.399] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.399] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.399] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.399] GetLastError () returned 0xea [0042.399] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.399] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\media player\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.399] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.400] SetEndOfFile (hFile=0xf8) returned 1 [0042.400] CloseHandle (hObject=0xf8) returned 1 [0042.400] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.400] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.400] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.401] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.401] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c2a210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.401] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c2a210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.401] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.401] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MF", cAlternateFileName="")) returned 1 [0042.401] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.401] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.401] CryptHashData (hHash=0x5c90c0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.401] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9040) returned 1 [0042.402] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.402] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.402] GetLastError () returned 0xea [0042.402] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.402] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\mf\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.402] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.403] SetEndOfFile (hFile=0xf8) returned 1 [0042.403] CloseHandle (hObject=0xf8) returned 1 [0042.403] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.403] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.403] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.403] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.403] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0042.403] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c2a210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.403] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0042.404] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0042.404] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.404] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MSDN", cAlternateFileName="")) returned 1 [0042.404] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.404] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.404] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.404] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.404] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.404] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.404] GetLastError () returned 0xea [0042.404] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.405] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\msdn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.405] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.406] SetEndOfFile (hFile=0xf8) returned 1 [0042.406] CloseHandle (hObject=0xf8) returned 1 [0042.406] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.406] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.406] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.407] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.407] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="8.0", cAlternateFileName="")) returned 1 [0042.407] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.407] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.407] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.407] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.407] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.407] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.408] GetLastError () returned 0xea [0042.408] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.408] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.408] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.409] SetEndOfFile (hFile=0xec) returned 1 [0042.409] CloseHandle (hObject=0xec) returned 1 [0042.409] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.409] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.409] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.410] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.410] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c2a210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.410] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c2a210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.410] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.410] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c2a210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.410] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c2a210, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c2a210, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c2a210, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.410] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.410] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0042.410] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.411] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.411] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.411] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0042.411] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.411] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.411] GetLastError () returned 0xea [0042.411] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.411] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\netframework\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.411] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.412] SetEndOfFile (hFile=0xf8) returned 1 [0042.412] CloseHandle (hObject=0xf8) returned 1 [0042.413] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.413] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.413] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.413] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.413] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0042.413] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.413] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.413] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.414] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9040) returned 1 [0042.414] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.414] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.414] GetLastError () returned 0xea [0042.414] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.414] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.416] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.419] SetEndOfFile (hFile=0xec) returned 1 [0042.419] CloseHandle (hObject=0xec) returned 1 [0042.419] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.419] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.419] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.419] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.419] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c50370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.419] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c50370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.419] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.420] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c50370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.420] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c50370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.420] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.420] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Network", cAlternateFileName="")) returned 1 [0042.420] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.420] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.420] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.420] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9040) returned 1 [0042.420] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.420] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.420] GetLastError () returned 0xea [0042.420] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.421] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\network\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.421] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.422] SetEndOfFile (hFile=0xf8) returned 1 [0042.422] CloseHandle (hObject=0xf8) returned 1 [0042.423] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.423] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.423] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.423] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.423] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0042.423] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.424] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.424] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.424] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0042.424] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.424] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.424] GetLastError () returned 0xea [0042.424] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.424] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.424] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.425] SetEndOfFile (hFile=0xec) returned 1 [0042.426] CloseHandle (hObject=0xec) returned 1 [0042.426] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.426] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.426] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.426] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.426] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c50370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.426] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c50370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.426] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.426] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0042.426] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.427] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.427] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.427] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.427] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.427] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.427] GetLastError () returned 0xea [0042.427] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.427] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.428] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.428] SetEndOfFile (hFile=0xec) returned 1 [0042.428] CloseHandle (hObject=0xec) returned 1 [0042.429] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.429] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.429] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9c764d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.429] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9c764d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.429] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9c764d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c764d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.429] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="qmgr0.dat", cAlternateFileName="")) returned 1 [0042.429] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="qmgr1.dat", cAlternateFileName="")) returned 1 [0042.429] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0 [0042.429] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.429] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c50370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.429] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c50370, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c50370, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c50370, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.429] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.429] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0042.429] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.430] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.430] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.430] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0042.430] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.430] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.430] GetLastError () returned 0xea [0042.430] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.430] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\office\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.431] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.432] SetEndOfFile (hFile=0xf8) returned 1 [0042.432] CloseHandle (hObject=0xf8) returned 1 [0042.432] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.432] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.432] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa9c764d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.432] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa9c764d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.432] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1 [0042.432] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1 [0042.432] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c764d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c764d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.432] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0042.432] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MySite.ico", cAlternateFileName="")) returned 1 [0042.432] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1 [0042.432] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1 [0042.432] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1 [0042.432] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.433] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.433] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.433] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0042.433] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.433] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.433] GetLastError () returned 0xea [0042.433] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.433] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.434] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.435] SetEndOfFile (hFile=0xec) returned 1 [0042.435] CloseHandle (hObject=0xec) returned 1 [0042.435] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.435] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.435] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa9c764d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.435] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa9c764d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.435] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1036", cAlternateFileName="")) returned 1 [0042.435] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.436] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.436] CryptHashData (hHash=0x5c9040, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.436] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f80) returned 1 [0042.436] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.436] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.436] GetLastError () returned 0xea [0042.436] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.436] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.437] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.438] SetEndOfFile (hFile=0xe8) returned 1 [0042.438] CloseHandle (hObject=0xe8) returned 1 [0042.438] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.438] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.438] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa9c764d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.438] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa9c764d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.438] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0042.438] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0042.438] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c764d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c764d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0042.439] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.439] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="3082", cAlternateFileName="")) returned 1 [0042.439] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.440] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.440] CryptHashData (hHash=0x5c8f80, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.440] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9040) returned 1 [0042.440] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.440] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.440] GetLastError () returned 0xea [0042.440] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.441] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.442] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.443] SetEndOfFile (hFile=0xe8) returned 1 [0042.443] CloseHandle (hObject=0xe8) returned 1 [0042.443] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.443] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.443] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa9c9c630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c9c630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.443] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa9c9c630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c9c630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.443] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0042.443] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xb960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0042.443] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x39960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0042.443] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c9c630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c9c630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c9c630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.443] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x47d60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0042.443] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0042.443] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x248aaf00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x248aaf00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x16f60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0042.443] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25bbdc00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25bbdc00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2b2560, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3564d600, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3564d600, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63b88300, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63b88300, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62875600, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62875600, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x35960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x9f560, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x315ed100, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x315ed100, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a4a9400, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1a4a9400, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0xd160, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19196700, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x19196700, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0x43560, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a560, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57655500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57655500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x87f60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2720b500, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2720b500, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x57f60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x94d0df00, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x94d0df00, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca190500, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xca190500, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70273800, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x70273800, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x73960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1789a00, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa1789a00, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x24360, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a9c700, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2a9c700, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x110b60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x23960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x126760, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0042.444] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c764d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c764d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c764d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c764d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c764d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x72742e4c, dwReserved1=0x6c645f78, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.444] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 0 [0042.444] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.444] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x536d6165, dwReserved1=0x2e657469, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0042.445] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.445] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.445] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.445] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.445] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.445] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.445] GetLastError () returned 0xea [0042.445] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.446] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.446] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.447] SetEndOfFile (hFile=0xf8) returned 1 [0042.447] CloseHandle (hObject=0xf8) returned 1 [0042.447] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.447] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.447] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9c9c630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c9c630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.447] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9c9c630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c9c630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.447] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Cache", cAlternateFileName="")) returned 1 [0042.447] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.448] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.448] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.448] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9040) returned 1 [0042.448] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.448] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.448] GetLastError () returned 0xea [0042.448] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.449] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.449] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.450] SetEndOfFile (hFile=0xec) returned 1 [0042.450] CloseHandle (hObject=0xec) returned 1 [0042.450] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.450] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.450] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9c9c630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c9c630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.450] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9c9c630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c9c630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.450] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cache.dat", cAlternateFileName="")) returned 1 [0042.450] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c9c630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c9c630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c9c630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.450] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c9c630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c9c630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c9c630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.450] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.450] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c9c630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c9c630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9c9c630, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.450] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="tokens.dat", cAlternateFileName="")) returned 1 [0042.451] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="tokens.dat", cAlternateFileName="")) returned 0 [0042.451] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.451] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="RAC", cAlternateFileName="")) returned 1 [0042.451] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.451] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.451] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.451] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9040) returned 1 [0042.451] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.451] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.451] GetLastError () returned 0xea [0042.451] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.452] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\rac\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.457] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.458] SetEndOfFile (hFile=0xf8) returned 1 [0042.458] CloseHandle (hObject=0xf8) returned 1 [0042.458] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.458] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.458] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9cc2790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9cc2790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.458] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9cc2790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9cc2790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.458] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9c9c630, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9c9c630, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9cc2790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.458] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Outbound", cAlternateFileName="")) returned 1 [0042.458] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.459] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.459] CryptHashData (hHash=0x5c90c0, pbData=0x33e1c54, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.459] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.459] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.459] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.459] GetLastError () returned 0xea [0042.459] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.459] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.460] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.460] SetEndOfFile (hFile=0xec) returned 1 [0042.461] CloseHandle (hObject=0xec) returned 1 [0042.461] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.461] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.461] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9cc2790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9cc2790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.461] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9cc2790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9cc2790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.461] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9cc2790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9cc2790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9cc2790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.461] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9cc2790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9cc2790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9cc2790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.461] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.461] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x959169c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x959169c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1 [0042.461] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.462] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.462] CryptHashData (hHash=0x5c8f40, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.462] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0042.462] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.462] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.462] GetLastError () returned 0xea [0042.462] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.462] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.467] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.468] SetEndOfFile (hFile=0xec) returned 1 [0042.468] CloseHandle (hObject=0xec) returned 1 [0042.468] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.469] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.469] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9cc2790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9cc2790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.469] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9cc2790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9cc2790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.469] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9cc2790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9cc2790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9cc2790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.469] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x959169c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9593cb20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 1 [0042.469] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x959169c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x9593cb20, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 0 [0042.469] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.469] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x959169c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x959169c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e657361, dwReserved1=0x52666473, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1 [0042.469] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.470] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.470] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.470] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.470] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.470] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.470] GetLastError () returned 0xea [0042.470] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.470] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.470] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.471] SetEndOfFile (hFile=0xec) returned 1 [0042.471] CloseHandle (hObject=0xec) returned 1 [0042.471] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.471] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.471] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9cc2790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9cc2790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.472] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9cc2790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9cc2790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.472] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9cc2790, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9cc2790, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9cc2790, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.473] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb35800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xecb35800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xbddb7d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 1 [0042.473] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 1 [0042.473] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 0 [0042.473] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.473] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x95a474c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x95a474c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461642e, dwReserved1=0x52434e45, cFileName="Temp", cAlternateFileName="")) returned 1 [0042.473] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.473] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.473] CryptHashData (hHash=0x5c8f40, pbData=0x33e1c64, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.473] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0042.473] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.473] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.473] GetLastError () returned 0xea [0042.473] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.474] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.474] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.475] SetEndOfFile (hFile=0xec) returned 1 [0042.475] CloseHandle (hObject=0xec) returned 1 [0042.475] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.475] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.475] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.475] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.475] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ce88f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.475] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95a21360, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x95a21360, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x95a21360, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="sql3274.tmp", cAlternateFileName="")) returned 1 [0042.475] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95a474c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x95a474c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x95a474c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="sql3285.tmp", cAlternateFileName="")) returned 1 [0042.475] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95a474c0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0x95a474c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x95a474c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="sql3285.tmp", cAlternateFileName="")) returned 0 [0042.475] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.475] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x95a474c0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0x95a474c0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461642e, dwReserved1=0x52434e45, cFileName="Temp", cAlternateFileName="")) returned 0 [0042.476] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.476] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20456174, dwReserved1=0x52434e45, cFileName="Search", cAlternateFileName="")) returned 1 [0042.476] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.476] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.476] CryptHashData (hHash=0x5c9040, pbData=0x33e1c54, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.476] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.476] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.476] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.476] GetLastError () returned 0xea [0042.476] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.477] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.477] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.478] SetEndOfFile (hFile=0xf8) returned 1 [0042.478] CloseHandle (hObject=0xf8) returned 1 [0042.478] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.478] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.478] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.478] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.478] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Data", cAlternateFileName="")) returned 1 [0042.478] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.479] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.479] CryptHashData (hHash=0x5c9040, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.479] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.479] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.479] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.479] GetLastError () returned 0xea [0042.479] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.479] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.480] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.481] SetEndOfFile (hFile=0xec) returned 1 [0042.481] CloseHandle (hObject=0xec) returned 1 [0042.481] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.481] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.481] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.481] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.481] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1 [0042.481] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.482] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.482] CryptHashData (hHash=0x5c9040, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.482] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f80) returned 1 [0042.482] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.482] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.482] GetLastError () returned 0xea [0042.482] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.482] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.482] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.484] SetEndOfFile (hFile=0xe8) returned 1 [0042.484] CloseHandle (hObject=0xe8) returned 1 [0042.484] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.484] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.484] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.484] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.484] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ce88f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.484] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows", cAlternateFileName="")) returned 1 [0042.484] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.485] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.485] CryptHashData (hHash=0x5c9040, pbData=0x1fe5350, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.485] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0042.485] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.485] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.485] GetLastError () returned 0xea [0042.485] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.485] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.485] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.486] SetEndOfFile (hFile=0xf0) returned 1 [0042.486] CloseHandle (hObject=0xf0) returned 1 [0042.486] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.486] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.486] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.487] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.487] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Config", cAlternateFileName="")) returned 1 [0042.487] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0042.488] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0042.488] CryptHashData (hHash=0x5c9040, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.488] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9100) returned 1 [0042.488] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.488] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ecd8) returned 0 [0042.488] GetLastError () returned 0xea [0042.488] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0042.488] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\config\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.489] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0042.490] SetEndOfFile (hFile=0x108) returned 1 [0042.490] CloseHandle (hObject=0x108) returned 1 [0042.490] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.490] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.490] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d0ea50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d0ea50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.490] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d0ea50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d0ea50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.490] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d0ea50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d0ea50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d0ea50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.490] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d0ea50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d0ea50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d0ea50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.490] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.490] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="GatherLogs", cAlternateFileName="GATHER~1")) returned 1 [0042.490] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0042.491] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0042.491] CryptHashData (hHash=0x5c9100, pbData=0x33e1c68, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.491] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9040) returned 1 [0042.491] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.491] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ecd8) returned 0 [0042.491] GetLastError () returned 0xea [0042.491] CryptEncrypt (in: hKey=0x5c9040, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0042.491] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.492] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0042.492] SetEndOfFile (hFile=0x108) returned 1 [0042.493] CloseHandle (hObject=0x108) returned 1 [0042.493] CryptDestroyKey (hKey=0x5c9040) returned 1 [0042.493] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.493] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d0ea50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d0ea50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9040 [0042.493] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d0ea50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d0ea50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.493] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d0ea50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d0ea50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d0ea50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.493] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1 [0042.493] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0042.494] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0042.494] CryptHashData (hHash=0x5c9100, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.494] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c91c0) returned 1 [0042.494] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.494] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ea70) returned 0 [0042.494] GetLastError () returned 0xea [0042.494] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0042.494] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0042.498] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.499] SetEndOfFile (hFile=0x114) returned 1 [0042.499] CloseHandle (hObject=0x114) returned 1 [0042.500] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.500] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.500] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d0ea50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d0ea50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.500] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d0ea50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d0ea50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.500] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d0ea50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d0ea50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d0ea50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.500] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SystemIndex.1.Crwl", cAlternateFileName="SYSTEM~1.CRW")) returned 1 [0042.500] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 1 [0042.500] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b773330, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 0 [0042.500] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.500] FindNextFileA (in: hFindFile=0x5c9040, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29932700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29932700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29932700, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0 [0042.500] FindClose (in: hFindFile=0x5c9040 | out: hFindFile=0x5c9040) returned 1 [0042.500] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ce88f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.500] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MSS.chk", cAlternateFileName="")) returned 1 [0042.500] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295a0600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295a0600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MSS.log", cAlternateFileName="")) returned 1 [0042.500] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295c6760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295c6760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MSSres00001.jrs", cAlternateFileName="MSSRES~1.JRS")) returned 1 [0042.500] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x295ec8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x295ec8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x295ec8c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MSSres00002.jrs", cAlternateFileName="MSSRES~2.JRS")) returned 1 [0042.500] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27eb7240, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Projects", cAlternateFileName="")) returned 1 [0042.500] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0042.501] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0042.501] CryptHashData (hHash=0x5c9040, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.501] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c91c0) returned 1 [0042.501] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.501] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ecd8) returned 0 [0042.501] GetLastError () returned 0xea [0042.501] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0042.502] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.502] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0042.503] SetEndOfFile (hFile=0x108) returned 1 [0042.503] CloseHandle (hObject=0x108) returned 1 [0042.503] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.503] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.503] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d0ea50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d0ea50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.503] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d0ea50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d0ea50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.503] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d0ea50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d0ea50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d0ea50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.503] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1 [0042.503] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0042.504] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0042.504] CryptHashData (hHash=0x5c9040, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.504] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9100) returned 1 [0042.504] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.504] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ea70) returned 0 [0042.504] GetLastError () returned 0xea [0042.504] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0042.504] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0042.505] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.505] SetEndOfFile (hFile=0x114) returned 1 [0042.506] CloseHandle (hObject=0x114) returned 1 [0042.506] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.506] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.506] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.506] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.506] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d34bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.506] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Indexer", cAlternateFileName="")) returned 1 [0042.506] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0042.506] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0042.506] CryptHashData (hHash=0x5c9040, pbData=0x1fe5350, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.507] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9200) returned 1 [0042.507] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.507] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18e808) returned 0 [0042.507] GetLastError () returned 0xea [0042.507] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18e804*=0x260) returned 1 [0042.507] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.507] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0042.508] SetEndOfFile (hFile=0x104) returned 1 [0042.508] CloseHandle (hObject=0x104) returned 1 [0042.508] CryptDestroyKey (hKey=0x5c9200) returned 1 [0042.508] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.509] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0042.509] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.509] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiFiles", cAlternateFileName="")) returned 1 [0042.509] CryptAcquireContextA (in: phProv=0x18e594, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e594*=0x5d0e80) returned 1 [0042.509] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e54c | out: phHash=0x18e54c) returned 1 [0042.509] CryptHashData (hHash=0x5c9040, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.509] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9040, dwFlags=0x0, phKey=0x18e590 | out: phKey=0x18e590*=0x5c9080) returned 1 [0042.509] CryptDestroyHash (hHash=0x5c9040) returned 1 [0042.509] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18e5a0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18e5a0) returned 0 [0042.509] GetLastError () returned 0xea [0042.509] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18e59c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18e59c*=0x260) returned 1 [0042.510] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0042.511] WriteFile (in: hFile=0xfc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e320, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e320*=0x7a0, lpOverlapped=0x0) returned 1 [0042.512] SetEndOfFile (hFile=0xfc) returned 1 [0042.512] CloseHandle (hObject=0xfc) returned 1 [0042.512] CryptDestroyKey (hKey=0x5c9080) returned 1 [0042.512] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.512] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*.*", lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299f0de0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299f0de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiAB0001.000", cAlternateFileName="")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiAB0001.001", cAlternateFileName="")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a16f40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a16f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a16f40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiAB0001.002", cAlternateFileName="")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiAB0002.000", cAlternateFileName="")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiAB0002.001", cAlternateFileName="")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29a3d0a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiAB0002.002", cAlternateFileName="")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299f0de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiAD0001.000", cAlternateFileName="")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiAD0001.001", cAlternateFileName="")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x299cac80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x299cac80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x299cac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiAD0001.002", cAlternateFileName="")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d34bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="INDEX.000", cAlternateFileName="")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="INDEX.001", cAlternateFileName="")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2997e9c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2997e9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2997e9c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="INDEX.002", cAlternateFileName="")) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 1 [0042.513] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e538 | out: lpFindFileData=0x18e538*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 0 [0042.513] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0042.513] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d34bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20455241, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.513] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d34bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20455241, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.513] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0042.513] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="PropMap", cAlternateFileName="")) returned 1 [0042.513] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0042.513] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0042.513] CryptHashData (hHash=0x5c9200, pbData=0x1fe5350, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.513] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9080) returned 1 [0042.513] CryptDestroyHash (hHash=0x5c9200) returned 1 [0042.513] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18e808) returned 0 [0042.514] GetLastError () returned 0xea [0042.514] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18e804*=0x260) returned 1 [0042.514] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.514] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0042.515] SetEndOfFile (hFile=0x104) returned 1 [0042.515] CloseHandle (hObject=0x104) returned 1 [0042.515] CryptDestroyKey (hKey=0x5c9080) returned 1 [0042.515] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.515] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0042.516] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.516] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27eb7240, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiPT0000.000", cAlternateFileName="")) returned 1 [0042.516] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiPT0000.001", cAlternateFileName="")) returned 1 [0042.516] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27edd3a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27f75920, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiPT0000.002", cAlternateFileName="")) returned 1 [0042.516] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d34bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.516] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d34bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.516] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0042.516] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="SecStore", cAlternateFileName="")) returned 1 [0042.516] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0042.516] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0042.516] CryptHashData (hHash=0x5c9080, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.516] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9200) returned 1 [0042.517] CryptDestroyHash (hHash=0x5c9080) returned 1 [0042.517] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18e808) returned 0 [0042.517] GetLastError () returned 0xea [0042.517] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18e804*=0x260) returned 1 [0042.517] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0042.517] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0042.518] SetEndOfFile (hFile=0x104) returned 1 [0042.518] CloseHandle (hObject=0x104) returned 1 [0042.518] CryptDestroyKey (hKey=0x5c9200) returned 1 [0042.518] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.518] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0042.519] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.519] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiST0000.000", cAlternateFileName="")) returned 1 [0042.519] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiST0000.001", cAlternateFileName="")) returned 1 [0042.519] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x420c80b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CiST0000.002", cAlternateFileName="")) returned 1 [0042.519] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d34bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.519] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d34bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d34bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d34bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.519] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0042.519] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="SecStore", cAlternateFileName="")) returned 0 [0042.519] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.519] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29958860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29958860, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0 [0042.519] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.519] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows.edb", cAlternateFileName="")) returned 1 [0042.519] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29612a20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x42291130, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows.edb", cAlternateFileName="")) returned 0 [0042.519] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.519] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29612a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29612a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows", cAlternateFileName="")) returned 0 [0042.519] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.519] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ce88f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.519] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Temp", cAlternateFileName="")) returned 1 [0042.519] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.520] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.520] CryptHashData (hHash=0x5c8f80, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.520] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0042.520] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.520] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.520] GetLastError () returned 0xea [0042.520] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.520] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.521] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.522] SetEndOfFile (hFile=0xe8) returned 1 [0042.522] CloseHandle (hObject=0xe8) returned 1 [0042.522] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.522] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.522] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d5ad10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.522] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d5ad10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.522] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d5ad10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d5ad10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.522] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d5ad10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d5ad10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.522] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.522] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x422b7290, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Temp", cAlternateFileName="")) returned 0 [0042.522] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.522] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ce88f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.522] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ce88f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ce88f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ce88f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.522] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.523] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0042.523] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.523] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.523] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.523] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0042.523] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.523] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.523] GetLastError () returned 0xea [0042.523] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.524] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.524] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.525] SetEndOfFile (hFile=0xf8) returned 1 [0042.525] CloseHandle (hObject=0xf8) returned 1 [0042.525] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.525] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.525] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d5ad10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.525] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d5ad10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.525] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29423840, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5p5NrGJn0jS HALPmcxz.dat", cAlternateFileName="5P5NRG~1.DAT")) returned 1 [0042.525] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1 [0042.525] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.526] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.526] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.526] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8ec0) returned 1 [0042.526] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.526] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.526] GetLastError () returned 0xea [0042.526] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.526] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.529] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.530] SetEndOfFile (hFile=0xec) returned 1 [0042.530] CloseHandle (hObject=0xec) returned 1 [0042.530] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.530] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.530] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d5ad10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d5ad10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d5ad10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d5ad10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile10.bmp", cAlternateFileName="")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile11.bmp", cAlternateFileName="")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile12.bmp", cAlternateFileName="")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile13.bmp", cAlternateFileName="")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile14.bmp", cAlternateFileName="")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile15.bmp", cAlternateFileName="")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile16.bmp", cAlternateFileName="")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile17.bmp", cAlternateFileName="")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile18.bmp", cAlternateFileName="")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile19.bmp", cAlternateFileName="")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile20.bmp", cAlternateFileName="")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile21.bmp", cAlternateFileName="")) returned 1 [0042.530] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile22.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile23.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile24.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile25.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile26.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile27.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile28.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile29.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae46478a, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae46478a, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile30.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile31.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd42216d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile32.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b0a44, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4b0a44, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd4482cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile33.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9c9561, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile34.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile35.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae548fb8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae548fb8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile36.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae595272, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae595272, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile37.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5bb3cf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5bb3cf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile38.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5e152c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5e152c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc2ab41, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile39.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae607689, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae607689, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc50c9f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile40.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae62d7e6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae62d7e6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddcc30b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile41.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddce9217, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile42.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd0f375, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile43.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile44.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="usertile44.bmp", cAlternateFileName="")) returned 0 [0042.531] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x20706d62, dwReserved1=0x52434e45, cFileName="guest.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d5ad10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d5ad10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20706d62, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x20706d62, dwReserved1=0x52434e45, cFileName="user.bmp", cAlternateFileName="")) returned 1 [0042.531] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x20706d62, dwReserved1=0x52434e45, cFileName="user.bmp", cAlternateFileName="")) returned 0 [0042.531] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.532] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Vault", cAlternateFileName="")) returned 1 [0042.532] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.532] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.532] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.532] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8ec0) returned 1 [0042.532] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.532] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.532] GetLastError () returned 0xea [0042.532] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.533] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\vault\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.533] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.534] SetEndOfFile (hFile=0xf8) returned 1 [0042.534] CloseHandle (hObject=0xf8) returned 1 [0042.534] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.534] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.534] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d5ad10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.535] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d5ad10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.535] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d5ad10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.535] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d5ad10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d5ad10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.535] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.535] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="VISIO", cAlternateFileName="")) returned 1 [0042.535] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.535] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.535] CryptHashData (hHash=0x5c8ec0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.535] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0042.535] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.535] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.535] GetLastError () returned 0xea [0042.535] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.536] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\visio\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.536] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.537] SetEndOfFile (hFile=0xf8) returned 1 [0042.537] CloseHandle (hObject=0xf8) returned 1 [0042.537] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.537] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.537] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.538] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.538] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d80e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.538] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d80e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.538] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.538] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows", cAlternateFileName="")) returned 1 [0042.538] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.538] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.538] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.539] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8ec0) returned 1 [0042.539] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.539] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.539] GetLastError () returned 0xea [0042.539] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.539] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.539] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.540] SetEndOfFile (hFile=0xf8) returned 1 [0042.540] CloseHandle (hObject=0xf8) returned 1 [0042.540] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.540] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.540] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.541] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.541] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AIT", cAlternateFileName="")) returned 1 [0042.541] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.541] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.541] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.541] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0042.541] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.541] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.541] GetLastError () returned 0xea [0042.541] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.542] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\ait\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.542] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.543] SetEndOfFile (hFile=0xec) returned 1 [0042.543] CloseHandle (hObject=0xec) returned 1 [0042.543] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.543] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.543] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.544] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.544] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d80e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.544] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d80e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.544] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.544] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Caches", cAlternateFileName="")) returned 1 [0042.544] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.544] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.544] CryptHashData (hHash=0x5c90c0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.544] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.544] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.545] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.545] GetLastError () returned 0xea [0042.545] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.545] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.545] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.546] SetEndOfFile (hFile=0xec) returned 1 [0042.546] CloseHandle (hObject=0xec) returned 1 [0042.546] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.546] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.546] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.547] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.547] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x284cecd2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x284cecd2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x284cecd2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cversions.2.db", cAlternateFileName="CVERSI~1.DB")) returned 1 [0042.547] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d80e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.547] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x10f4d170, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x10f4d170, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x10f4d170, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{11336D5B-7F61-4871-82E3-E0F59766823B}.2.ver0x0000000000000001.db", cAlternateFileName="{11336~1.DB")) returned 1 [0042.547] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x75fef9b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x75fef9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75fef9b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{3978EA0A-1C7E-4449-8AE1-E1265F039002}.2.ver0x0000000000000003.db", cAlternateFileName="{3978E~1.DB")) returned 1 [0042.547] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf67691e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xcf67691e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xcf67691e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db", cAlternateFileName="{40FC8~1.DB")) returned 1 [0042.547] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b7d54e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9b7d54e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b7d54e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{4E36EA69-73D1-4458-9D16-50F8E31A69A0}.2.ver0x0000000000000001.db", cAlternateFileName="{4E36E~1.DB")) returned 1 [0042.547] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab9fb9ff, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab9fb9ff, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab9fb9ff, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db", cAlternateFileName="{4E426~2.DB")) returned 1 [0042.547] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76015b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x76015b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76015b10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2f390, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000011.db", cAlternateFileName="{6AF06~1.DB")) returned 1 [0042.547] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b8217a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9b8217a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b8217a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f5f0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db", cAlternateFileName="{6AF06~2.DB")) returned 1 [0042.547] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab96347e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab96347e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab96347e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x65578, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db", cAlternateFileName="{DDF57~2.DB")) returned 1 [0042.547] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab96347e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab96347e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab96347e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x65578, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db", cAlternateFileName="{DDF57~2.DB")) returned 0 [0042.547] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.547] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d383945, dwReserved1=0x44363234, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1 [0042.547] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.548] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.548] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.548] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0042.548] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.548] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.548] GetLastError () returned 0xea [0042.548] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.548] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.549] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.550] SetEndOfFile (hFile=0xec) returned 1 [0042.550] CloseHandle (hObject=0xec) returned 1 [0042.550] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.550] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.550] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.550] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.550] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0042.550] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.551] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.551] CryptHashData (hHash=0x5c8f40, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.551] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f80) returned 1 [0042.551] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.551] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.551] GetLastError () returned 0xea [0042.551] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.551] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.552] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.552] SetEndOfFile (hFile=0xe8) returned 1 [0042.553] CloseHandle (hObject=0xe8) returned 1 [0042.553] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.553] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.553] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.553] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.553] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", cAlternateFileName="")) returned 1 [0042.553] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 1 [0042.553] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9da6fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.553] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9da6fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.553] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.553] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d80e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.553] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d80e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.553] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.553] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="DRM", cAlternateFileName="")) returned 1 [0042.553] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.554] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.554] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.554] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f80) returned 1 [0042.554] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.554] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.554] GetLastError () returned 0xea [0042.554] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.554] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\drm\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.555] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.556] SetEndOfFile (hFile=0xec) returned 1 [0042.556] CloseHandle (hObject=0xec) returned 1 [0042.556] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.556] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.556] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.556] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.556] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Cache", cAlternateFileName="")) returned 1 [0042.556] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.557] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.557] CryptHashData (hHash=0x5c90c0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.557] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f40) returned 1 [0042.557] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.557] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.557] GetLastError () returned 0xea [0042.557] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.558] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\drm\\cache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.558] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.559] SetEndOfFile (hFile=0xe8) returned 1 [0042.559] CloseHandle (hObject=0xe8) returned 1 [0042.559] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.559] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.559] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.559] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.559] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9da6fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.559] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9da6fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.559] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.559] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9da6fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.559] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9da6fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.559] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.560] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0042.560] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.560] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.560] CryptHashData (hHash=0x5c8f80, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.560] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.560] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.560] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.560] GetLastError () returned 0xea [0042.560] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.561] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\gameexplorer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.561] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.562] SetEndOfFile (hFile=0xec) returned 1 [0042.562] CloseHandle (hObject=0xec) returned 1 [0042.562] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.562] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.562] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.562] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.563] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9da6fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.563] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9da6fd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9da6fd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9da6fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.563] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.563] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9d80e70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9d80e70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9d80e70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.563] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1 [0042.563] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.563] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.563] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.563] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f80) returned 1 [0042.563] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.563] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.563] GetLastError () returned 0xea [0042.563] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.564] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.567] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.568] SetEndOfFile (hFile=0xec) returned 1 [0042.568] CloseHandle (hObject=0xec) returned 1 [0042.568] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.568] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.568] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.569] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.569] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f828940, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x2b0000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="energy-ntkl.etl", cAlternateFileName="ENERGY~2.ETL")) returned 1 [0042.569] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9bd2ca0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9bd2ca0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xd9bd2ca0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x7122, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="energy-report-2017-07-12.xml", cAlternateFileName="ENERGY~2.XML")) returned 1 [0042.569] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e53620, ftCreationTime.dwHighDateTime=0x1d305f5, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="energy-report-2017-07-26.xml", cAlternateFileName="ENERGY~3.XML")) returned 1 [0042.569] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b145c0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9b145c0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="energy-report-latest.xml", cAlternateFileName="ENERGY~1.XML")) returned 1 [0042.569] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c91380, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9c91380, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x812c9f60, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x41f0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="energy-report.html", cAlternateFileName="ENERGY~1.HTM")) returned 1 [0042.569] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="energy-trace.etl", cAlternateFileName="ENERGY~1.ETL")) returned 1 [0042.569] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9dcd130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.569] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9dcd130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.569] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.569] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa5ab4510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5ab4510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0042.569] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.570] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.570] CryptHashData (hHash=0x5c8f80, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.570] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.570] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.570] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.570] GetLastError () returned 0xea [0042.570] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.570] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.570] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.571] SetEndOfFile (hFile=0xec) returned 1 [0042.571] CloseHandle (hObject=0xec) returned 1 [0042.571] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.571] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.571] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5a8e3b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5a8e3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5a8e3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9dcd130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 0 [0042.572] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616d772e, dwReserved1=0x52434e45, cFileName="Sqm", cAlternateFileName="")) returned 1 [0042.572] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.573] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.573] CryptHashData (hHash=0x5c8f40, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.573] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f80) returned 1 [0042.573] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.573] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.573] GetLastError () returned 0xea [0042.573] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.573] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.574] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.575] SetEndOfFile (hFile=0xec) returned 1 [0042.575] CloseHandle (hObject=0xec) returned 1 [0042.575] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.575] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.575] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.575] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.575] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9dcd130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.575] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Manifest", cAlternateFileName="")) returned 1 [0042.575] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.576] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.576] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.576] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0042.576] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.576] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.576] GetLastError () returned 0xea [0042.576] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.576] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\manifest\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.577] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.578] SetEndOfFile (hFile=0xe8) returned 1 [0042.578] CloseHandle (hObject=0xe8) returned 1 [0042.578] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.578] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.578] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.578] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.578] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9dcd130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.578] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9dcd130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.578] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.578] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Sessions", cAlternateFileName="")) returned 1 [0042.578] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.579] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.579] CryptHashData (hHash=0x5c90c0, pbData=0x33e1c64, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.579] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f40) returned 1 [0042.579] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.579] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.579] GetLastError () returned 0xea [0042.579] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.579] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\sessions\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.580] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.580] SetEndOfFile (hFile=0xe8) returned 1 [0042.581] CloseHandle (hObject=0xe8) returned 1 [0042.581] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.581] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.581] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.581] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.581] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9dcd130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.581] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9dcd130, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9dcd130, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9dcd130, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.581] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.581] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Upload", cAlternateFileName="")) returned 1 [0042.581] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.582] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.582] CryptHashData (hHash=0x5c8f40, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.582] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0042.582] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.582] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.582] GetLastError () returned 0xea [0042.582] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.582] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\sqm\\upload\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.583] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.583] SetEndOfFile (hFile=0xe8) returned 1 [0042.584] CloseHandle (hObject=0xe8) returned 1 [0042.584] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.584] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.584] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.584] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.584] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9df3290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.584] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9df3290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.584] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.584] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Upload", cAlternateFileName="")) returned 0 [0042.584] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.584] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa62e30b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa62e30b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0042.584] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.585] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.585] CryptHashData (hHash=0x5c8f80, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.585] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0042.585] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.585] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.585] GetLastError () returned 0xea [0042.585] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.585] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.586] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.587] SetEndOfFile (hFile=0xec) returned 1 [0042.587] CloseHandle (hObject=0xec) returned 1 [0042.587] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.587] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.587] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.587] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.587] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5ab4510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5ab4510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5ab4510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Default Programs.lnk.crypt", cAlternateFileName="DEFAUL~1.CRY")) returned 1 [0042.587] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5ab4510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5ab4510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5ab4510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.587] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9df3290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.587] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa62e30b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa62e30b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Programs", cAlternateFileName="")) returned 1 [0042.587] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.588] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.588] CryptHashData (hHash=0x5c8f80, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.588] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f40) returned 1 [0042.588] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.588] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.588] GetLastError () returned 0xea [0042.588] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.588] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.589] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.590] SetEndOfFile (hFile=0xe8) returned 1 [0042.590] CloseHandle (hObject=0xe8) returned 1 [0042.590] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.590] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.590] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.590] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.590] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa5d15b10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d15b10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0042.590] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.591] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.591] CryptHashData (hHash=0x5c8f80, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.591] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c91c0) returned 1 [0042.591] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.591] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.591] GetLastError () returned 0xea [0042.591] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.591] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.592] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.592] SetEndOfFile (hFile=0xf0) returned 1 [0042.593] CloseHandle (hObject=0xf0) returned 1 [0042.593] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.593] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.593] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.593] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.593] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa5ada670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5ada670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0042.593] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0042.593] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0042.593] CryptHashData (hHash=0x5c8f80, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.594] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9100) returned 1 [0042.594] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.594] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ecd8) returned 0 [0042.594] GetLastError () returned 0xea [0042.594] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0042.594] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.595] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0042.595] SetEndOfFile (hFile=0x108) returned 1 [0042.595] CloseHandle (hObject=0x108) returned 1 [0042.596] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.596] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.596] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.596] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5ada670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5ada670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5ada670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9df3290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5ada670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5ada670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5ada670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Speech Recognition.lnk.crypt", cAlternateFileName="SPEECH~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5ada670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5ada670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5ada670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Speech Recognition.lnk.crypt", cAlternateFileName="SPEECH~1.CRY")) returned 0 [0042.596] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5ada670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5ada670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5b007d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="Calculator.lnk.crypt", cAlternateFileName="CALCUL~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b007d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5b007d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5b007d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b007d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5b007d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5b007d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="displayswitch.lnk.crypt", cAlternateFileName="DISPLA~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9df3290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b007d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5b007d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5b26930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="Math Input Panel.lnk.crypt", cAlternateFileName="MATHIN~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b26930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5b26930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5b26930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="Mobility Center.lnk.crypt", cAlternateFileName="MOBILI~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b26930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5b26930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5b4ca90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="NetworkProjection.lnk.crypt", cAlternateFileName="NETWOR~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b4ca90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5b4ca90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5b4ca90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="Paint.lnk.crypt", cAlternateFileName="PAINTL~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b4ca90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5b4ca90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5b72bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="Remote Desktop Connection.lnk.crypt", cAlternateFileName="REMOTE~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b72bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5b72bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5b72bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="Snipping Tool.lnk.crypt", cAlternateFileName="SNIPPI~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b72bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5b72bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5b72bf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="Sound Recorder.lnk.crypt", cAlternateFileName="SOUNDR~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b72bf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5b72bf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5b98d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="Sticky Notes.lnk.crypt", cAlternateFileName="STICKY~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b98d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5b98d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5b98d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="Sync Center.lnk.crypt", cAlternateFileName="SYNCCE~1.CRY")) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa5c7d590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5c7d590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0042.597] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0042.597] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0042.597] CryptHashData (hHash=0x5c9100, pbData=0x33e1c74, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.597] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8f80) returned 1 [0042.597] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.597] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ecd8) returned 0 [0042.597] GetLastError () returned 0xea [0042.597] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0042.598] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.598] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0042.599] SetEndOfFile (hFile=0x108) returned 1 [0042.599] CloseHandle (hObject=0x108) returned 1 [0042.599] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.599] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.599] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.599] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.599] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b98d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5b98d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5b98d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Character Map.lnk.crypt", cAlternateFileName="CHARAC~1.CRY")) returned 1 [0042.599] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b98d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5b98d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5bbeeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.599] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bbeeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5bbeeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5bbeeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="dfrgui.lnk.crypt", cAlternateFileName="DFRGUI~1.CRY")) returned 1 [0042.599] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bbeeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5bbeeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5bbeeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Disk Cleanup.lnk.crypt", cAlternateFileName="DISKCL~1.CRY")) returned 1 [0042.599] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e193f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.600] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bbeeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5bbeeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5be5010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Resource Monitor.lnk.crypt", cAlternateFileName="RESOUR~1.CRY")) returned 1 [0042.600] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5be5010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5be5010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5be5010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="System Information.lnk.crypt", cAlternateFileName="SYSTEM~1.CRY")) returned 1 [0042.600] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5be5010, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5be5010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5c0b170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="System Restore.lnk.crypt", cAlternateFileName="SYSTEM~2.CRY")) returned 1 [0042.600] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5c0b170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5c0b170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5c0b170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Task Scheduler.lnk.crypt", cAlternateFileName="TASKSC~1.CRY")) returned 1 [0042.600] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5c0b170, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5c0b170, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5c7d590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Easy Transfer Reports.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 1 [0042.600] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5c7d590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5c7d590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5c7d590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Easy Transfer.lnk.crypt", cAlternateFileName="WINDOW~2.CRY")) returned 1 [0042.600] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5c7d590, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5c7d590, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5c7d590, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Easy Transfer.lnk.crypt", cAlternateFileName="WINDOW~2.CRY")) returned 0 [0042.600] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.600] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa5cc9850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5cc9850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72542079, dwReserved1=0x66736e61, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0042.600] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0042.600] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0042.600] CryptHashData (hHash=0x5c8f80, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.600] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9100) returned 1 [0042.600] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.600] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ecd8) returned 0 [0042.601] GetLastError () returned 0xea [0042.601] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0042.601] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.601] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0042.602] SetEndOfFile (hFile=0x108) returned 1 [0042.603] CloseHandle (hObject=0x108) returned 1 [0042.603] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.603] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.603] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.603] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.603] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5ca36f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5ca36f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5ca36f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.603] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e193f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.603] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5ca36f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5ca36f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5ca36f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ShapeCollector.lnk.crypt", cAlternateFileName="SHAPEC~1.CRY")) returned 1 [0042.603] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5ca36f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5ca36f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5ca36f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="TabTip.lnk.crypt", cAlternateFileName="TABTIP~1.CRY")) returned 1 [0042.603] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5cc9850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5cc9850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5cc9850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Journal.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 1 [0042.603] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5cc9850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5cc9850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5cc9850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Journal.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 0 [0042.603] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.603] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5cc9850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5cc9850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5cc9850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x6c616e72, dwReserved1=0x6b6e6c2e, cFileName="Welcome Center.lnk.crypt", cAlternateFileName="WELCOM~1.CRY")) returned 1 [0042.603] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa5d15b10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d15b10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c616e72, dwReserved1=0x6b6e6c2e, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0042.603] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0042.604] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0042.604] CryptHashData (hHash=0x5c9100, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.604] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8f80) returned 1 [0042.604] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.604] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ecd8) returned 0 [0042.604] GetLastError () returned 0xea [0042.604] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0042.604] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.605] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0042.606] SetEndOfFile (hFile=0x108) returned 1 [0042.606] CloseHandle (hObject=0x108) returned 1 [0042.606] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.606] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.606] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.606] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.606] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5cc9850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5cc9850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5cc9850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.606] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e193f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.606] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5cc9850, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5cc9850, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5cef9b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows PowerShell (x86).lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 1 [0042.606] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5cef9b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5cef9b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5cef9b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows PowerShell ISE (x86).lnk.crypt", cAlternateFileName="WINDOW~2.CRY")) returned 1 [0042.606] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d15b10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5d15b10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d15b10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows PowerShell ISE.lnk.crypt", cAlternateFileName="WINDOW~3.CRY")) returned 1 [0042.606] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d15b10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5d15b10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d15b10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows PowerShell.lnk.crypt", cAlternateFileName="WINDOW~4.CRY")) returned 1 [0042.606] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d15b10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5d15b10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d15b10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows PowerShell.lnk.crypt", cAlternateFileName="WINDOW~4.CRY")) returned 0 [0042.606] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.606] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d15b10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5d15b10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d15b10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x68537265, dwReserved1=0x2e6c6c65, cFileName="Wordpad.lnk.crypt", cAlternateFileName="WORDPA~1.CRY")) returned 1 [0042.606] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d15b10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5d15b10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d15b10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x68537265, dwReserved1=0x2e6c6c65, cFileName="Wordpad.lnk.crypt", cAlternateFileName="WORDPA~1.CRY")) returned 0 [0042.606] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.606] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa5dfa350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5dfa350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7972632e, dwReserved1=0x2e6c7470, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0042.606] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.607] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.607] CryptHashData (hHash=0x5c91c0, pbData=0x33e1c74, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.607] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0042.607] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.607] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.607] GetLastError () returned 0xea [0042.607] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.607] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.608] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.609] SetEndOfFile (hFile=0xf0) returned 1 [0042.609] CloseHandle (hObject=0xf0) returned 1 [0042.609] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.609] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.609] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.609] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.609] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d3bc70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5d3bc70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d3bc70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Component Services.lnk.crypt", cAlternateFileName="COMPON~1.CRY")) returned 1 [0042.609] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d3bc70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5d3bc70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d3bc70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Computer Management.lnk.crypt", cAlternateFileName="COMPUT~1.CRY")) returned 1 [0042.609] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d3bc70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5d3bc70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d61dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Data Sources (ODBC).lnk.crypt", cAlternateFileName="DATASO~1.CRY")) returned 1 [0042.609] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d61dd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5d61dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d61dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.609] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d61dd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5d61dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d61dd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Event Viewer.lnk.crypt", cAlternateFileName="EVENTV~1.CRY")) returned 1 [0042.609] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e193f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.609] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d61dd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5d61dd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d87f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="iSCSI Initiator.lnk.crypt", cAlternateFileName="ISCSII~1.CRY")) returned 1 [0042.609] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d87f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5d87f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d87f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Memory Diagnostics Tool.lnk.crypt", cAlternateFileName="MEMORY~1.CRY")) returned 1 [0042.609] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d87f30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5d87f30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5d87f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Performance Monitor.lnk.crypt", cAlternateFileName="PERFOR~1.CRY")) returned 1 [0042.610] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5dae090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5dae090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5dae090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Print Management.lnk.crypt", cAlternateFileName="PRINTM~1.CRY")) returned 1 [0042.610] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5dae090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5dae090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5dae090, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Security Configuration Management.lnk.crypt", cAlternateFileName="SECURI~1.CRY")) returned 1 [0042.610] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5dae090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5dae090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5dd41f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="services.lnk.crypt", cAlternateFileName="SERVIC~1.CRY")) returned 1 [0042.610] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5dd41f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5dd41f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5dd41f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="System Configuration.lnk.crypt", cAlternateFileName="SYSTEM~1.CRY")) returned 1 [0042.610] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5dfa350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5dfa350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5dfa350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Task Scheduler.lnk.crypt", cAlternateFileName="TASKSC~1.CRY")) returned 1 [0042.610] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5dfa350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5dfa350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5dfa350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Firewall with Advanced Security.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 1 [0042.610] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5dfa350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5dfa350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5dfa350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows PowerShell Modules.lnk.crypt", cAlternateFileName="WINDOW~2.CRY")) returned 1 [0042.610] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5dfa350, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5dfa350, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5dfa350, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows PowerShell Modules.lnk.crypt", cAlternateFileName="WINDOW~2.CRY")) returned 0 [0042.610] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.610] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e204b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5e204b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5f9d270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0x68537265, dwReserved1=0x206c6c65, cFileName="Adobe Reader X.lnk.crypt", cAlternateFileName="ADOBER~1.CRY")) returned 1 [0042.610] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5f9d270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5f9d270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5f9d270, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x68537265, dwReserved1=0x206c6c65, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.610] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa605b950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa605b950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68537265, dwReserved1=0x206c6c65, cFileName="Games", cAlternateFileName="")) returned 1 [0042.610] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.610] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.611] CryptHashData (hHash=0x5c8f80, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.611] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c91c0) returned 1 [0042.611] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.611] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.611] GetLastError () returned 0xea [0042.611] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.611] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.611] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.614] SetEndOfFile (hFile=0xf0) returned 1 [0042.614] CloseHandle (hObject=0xf0) returned 1 [0042.614] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.614] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.614] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.615] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e193f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.615] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5f9d270, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5f9d270, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa5fc33d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.615] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5fc33d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa5fc33d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa605b950, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="GameExplorer.lnk.crypt", cAlternateFileName="GAMEEX~1.CRY")) returned 1 [0042.615] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e193f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.615] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e193f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e193f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.615] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.615] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa605b950, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa605b950, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6081ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Google Chrome.lnk.crypt", cAlternateFileName="GOOGLE~1.CRY")) returned 1 [0042.615] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9df3290, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9df3290, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9df3290, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.615] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa60cdd70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa60cdd70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Java", cAlternateFileName="")) returned 1 [0042.615] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.615] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.615] CryptHashData (hHash=0x5c91c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.615] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0042.615] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.616] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.616] GetLastError () returned 0xea [0042.616] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.616] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.616] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.617] SetEndOfFile (hFile=0xf0) returned 1 [0042.617] CloseHandle (hObject=0xf0) returned 1 [0042.617] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.617] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.617] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa9e3f550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.618] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa9e3f550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.618] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6081ab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6081ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6081ab0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="About Java.lnk.crypt", cAlternateFileName="ABOUTJ~1.CRY")) returned 1 [0042.618] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6081ab0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6081ab0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa60a7c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Check For Updates.lnk.crypt", cAlternateFileName="CHECKF~1.CRY")) returned 1 [0042.618] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60a7c10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa60a7c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa60a7c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Configure Java.lnk.crypt", cAlternateFileName="CONFIG~1.CRY")) returned 1 [0042.618] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60a7c10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa60a7c10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa60a7c10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Get Help.lnk.crypt", cAlternateFileName="GETHEL~1.CRY")) returned 1 [0042.618] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e3f550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e3f550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.618] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60cdd70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa60cdd70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa60cdd70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Visit Java.com.lnk.crypt", cAlternateFileName="VISITJ~1.CRY")) returned 1 [0042.618] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60cdd70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa60cdd70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa60cdd70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Visit Java.com.lnk.crypt", cAlternateFileName="VISITJ~1.CRY")) returned 0 [0042.618] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.618] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa611a030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa611a030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e6d6f63, dwReserved1=0x2e6b6e6c, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0042.618] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.619] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.619] CryptHashData (hHash=0x5c8f80, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.619] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c91c0) returned 1 [0042.619] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.619] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.619] GetLastError () returned 0xea [0042.619] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.619] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.619] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.620] SetEndOfFile (hFile=0xf0) returned 1 [0042.620] CloseHandle (hObject=0xf0) returned 1 [0042.621] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.621] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.621] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e3f550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.621] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e3f550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.621] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60cdd70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa60cdd70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa60f3ed0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Backup and Restore Center.lnk.crypt", cAlternateFileName="BACKUP~1.CRY")) returned 1 [0042.621] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60f3ed0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa60f3ed0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa611a030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Create Recovery Disc.lnk.crypt", cAlternateFileName="CREATE~1.CRY")) returned 1 [0042.621] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa611a030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa611a030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa611a030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.621] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e3f550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e3f550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.621] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa611a030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa611a030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa611a030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Remote Assistance.lnk.crypt", cAlternateFileName="REMOTE~1.CRY")) returned 1 [0042.621] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa611a030, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa611a030, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa611a030, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Remote Assistance.lnk.crypt", cAlternateFileName="REMOTE~1.CRY")) returned 0 [0042.621] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.621] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6140190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6140190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6140190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x6e617473, dwReserved1=0x6c2e6563, cFileName="Media Center.lnk.crypt", cAlternateFileName="MEDIAC~1.CRY")) returned 1 [0042.621] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa624ab30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa624ab30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e617473, dwReserved1=0x6c2e6563, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0042.621] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.622] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.622] CryptHashData (hHash=0x5c91c0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.622] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0042.622] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.622] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.622] GetLastError () returned 0xea [0042.622] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.622] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.623] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.623] SetEndOfFile (hFile=0xf0) returned 1 [0042.624] CloseHandle (hObject=0xf0) returned 1 [0042.624] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.624] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.624] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9e3f550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.624] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9e3f550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.624] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e3f550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e3f550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.624] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6140190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6140190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6140190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Access 2010.lnk.crypt", cAlternateFileName="MICROS~1.CRY")) returned 1 [0042.624] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6140190, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6140190, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6140190, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb87, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Excel 2010.lnk.crypt", cAlternateFileName="MICROS~2.CRY")) returned 1 [0042.624] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa61662f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa61662f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa61662f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft InfoPath Designer 2010.lnk.crypt", cAlternateFileName="MICROS~3.CRY")) returned 1 [0042.624] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa61662f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa61662f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa61662f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft InfoPath Filler 2010.lnk.crypt", cAlternateFileName="MICROS~4.CRY")) returned 1 [0042.624] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa61d8710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa61d8710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Office 2010 Tools", cAlternateFileName="MICROS~1")) returned 1 [0042.624] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0042.625] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0042.625] CryptHashData (hHash=0x5c91c0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.625] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9100) returned 1 [0042.625] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.625] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ecd8) returned 0 [0042.625] GetLastError () returned 0xea [0042.625] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0042.625] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.626] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0042.627] SetEndOfFile (hFile=0x108) returned 1 [0042.627] CloseHandle (hObject=0x108) returned 1 [0042.627] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.627] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.627] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9e3f550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.627] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9e3f550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa61662f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa61662f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa618c450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Digital Certificate for VBA Projects.lnk.crypt", cAlternateFileName="DIGITA~1.CRY")) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e3f550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e3f550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e3f550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa618c450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa618c450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa618c450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb65, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Clip Organizer.lnk.crypt", cAlternateFileName="MICROS~1.CRY")) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa618c450, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa618c450, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa618c450, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xabf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Office 2010 Language Preferences.lnk.crypt", cAlternateFileName="MICROS~2.CRY")) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa61b25b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa61b25b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa61b25b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Office 2010 Upload Center.lnk.crypt", cAlternateFileName="MICROS~3.CRY")) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa61b25b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa61b25b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa61b25b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb3b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Office Picture Manager.lnk.crypt", cAlternateFileName="MICROS~4.CRY")) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa61b25b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa61b25b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa61d8710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Project Server 2010 Accounts.lnk.crypt", cAlternateFileName="MICD39~1.CRY")) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa61b25b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa61b25b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa61d8710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Project Server 2010 Accounts.lnk.crypt", cAlternateFileName="MICD39~1.CRY")) returned 0 [0042.627] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa61d8710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa61d8710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa61d8710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb3f, dwReserved0=0x656a6f72, dwReserved1=0x53207463, cFileName="Microsoft OneNote 2010.lnk.crypt", cAlternateFileName="MI05CD~1.CRY")) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa61d8710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa61d8710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa61d8710, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbd5, dwReserved0=0x656a6f72, dwReserved1=0x53207463, cFileName="Microsoft Outlook 2010.lnk.crypt", cAlternateFileName="MI51E1~1.CRY")) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa61d8710, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa61d8710, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa61fe870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb79, dwReserved0=0x656a6f72, dwReserved1=0x53207463, cFileName="Microsoft PowerPoint 2010.lnk.crypt", cAlternateFileName="MI82C7~1.CRY")) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa61fe870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa61fe870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa61fe870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xb77, dwReserved0=0x656a6f72, dwReserved1=0x53207463, cFileName="Microsoft Project 2010.lnk.crypt", cAlternateFileName="MI5366~1.CRY")) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa61fe870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa61fe870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa61fe870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x656a6f72, dwReserved1=0x53207463, cFileName="Microsoft Publisher 2010.lnk.crypt", cAlternateFileName="MICD1E~1.CRY")) returned 1 [0042.627] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa61fe870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa61fe870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa62249d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x656a6f72, dwReserved1=0x53207463, cFileName="Microsoft SharePoint Workspace 2010.lnk.crypt", cAlternateFileName="MI1D8E~1.CRY")) returned 1 [0042.628] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa62249d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa62249d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa62249d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0x656a6f72, dwReserved1=0x53207463, cFileName="Microsoft Visio 2010.lnk.crypt", cAlternateFileName="MIA1EF~1.CRY")) returned 1 [0042.628] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa624ab30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa624ab30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa624ab30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x656a6f72, dwReserved1=0x53207463, cFileName="Microsoft Word 2010.lnk.crypt", cAlternateFileName="MI04A1~1.CRY")) returned 1 [0042.628] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa624ab30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa624ab30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa624ab30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x656a6f72, dwReserved1=0x53207463, cFileName="Microsoft Word 2010.lnk.crypt", cAlternateFileName="MI04A1~1.CRY")) returned 0 [0042.628] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.628] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa624ab30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa624ab30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa624ab30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x2064726f, dwReserved1=0x30313032, cFileName="Mozilla Firefox.lnk.crypt", cAlternateFileName="MOZILL~1.CRY")) returned 1 [0042.628] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6270c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6270c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2064726f, dwReserved1=0x30313032, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1 [0042.628] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.628] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.628] CryptHashData (hHash=0x5c8f80, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.628] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0042.628] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.628] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.628] GetLastError () returned 0xea [0042.628] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.629] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sharepoint\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.629] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.630] SetEndOfFile (hFile=0xf0) returned 1 [0042.630] CloseHandle (hObject=0xf0) returned 1 [0042.631] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.631] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.631] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.631] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.631] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e656b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.631] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6270c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6270c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6270c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft SharePoint Workspace 2010.lnk.crypt", cAlternateFileName="MICROS~1.CRY")) returned 1 [0042.631] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6270c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6270c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6270c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft SharePoint Workspace 2010.lnk.crypt", cAlternateFileName="MICROS~1.CRY")) returned 0 [0042.631] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.631] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6270c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6270c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6270c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x65726168, dwReserved1=0x6e696f50, cFileName="Sidebar.lnk.crypt", cAlternateFileName="SIDEBA~1.CRY")) returned 1 [0042.631] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6296df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6296df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726168, dwReserved1=0x6e696f50, cFileName="Startup", cAlternateFileName="")) returned 1 [0042.631] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.632] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.632] CryptHashData (hHash=0x5c9100, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.632] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0042.632] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.632] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.632] GetLastError () returned 0xea [0042.632] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.632] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.632] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.633] SetEndOfFile (hFile=0xf0) returned 1 [0042.633] CloseHandle (hObject=0xf0) returned 1 [0042.633] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.634] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.634] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.634] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.634] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6270c90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6270c90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6270c90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0042.634] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e656b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.634] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e656b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.634] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.634] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0042.634] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.634] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.634] CryptHashData (hHash=0x5c8f80, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.635] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0042.635] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.635] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.635] GetLastError () returned 0xea [0042.635] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.635] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\tablet pc\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.635] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.636] SetEndOfFile (hFile=0xf0) returned 1 [0042.636] CloseHandle (hObject=0xf0) returned 1 [0042.637] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.637] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.637] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.637] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.637] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e656b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.637] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e656b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.637] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.637] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6296df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6296df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6296df0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows Anytime Upgrade.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 1 [0042.637] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6296df0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6296df0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa62bcf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows DVD Maker.lnk.crypt", cAlternateFileName="WINDOW~2.CRY")) returned 1 [0042.637] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa62bcf50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa62bcf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa62bcf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows Fax and Scan.lnk.crypt", cAlternateFileName="WINDOW~3.CRY")) returned 1 [0042.637] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa62bcf50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa62bcf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa62bcf50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows Media Player.lnk.crypt", cAlternateFileName="WINDOW~4.CRY")) returned 1 [0042.637] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa62bcf50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa62bcf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa62e30b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="XPS Viewer.lnk.crypt", cAlternateFileName="XPSVIE~1.CRY")) returned 1 [0042.637] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa62bcf50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa62bcf50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa62e30b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="XPS Viewer.lnk.crypt", cAlternateFileName="XPSVIE~1.CRY")) returned 0 [0042.637] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.637] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa62e30b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa62e30b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa62e30b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x2e6b6e6c, dwReserved1=0x70797263, cFileName="Windows Update.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 1 [0042.637] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa62e30b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa62e30b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa62e30b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x2e6b6e6c, dwReserved1=0x70797263, cFileName="Windows Update.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 0 [0042.637] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.638] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e657461, dwReserved1=0x2e6b6e6c, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0042.638] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.638] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.638] CryptHashData (hHash=0x5c90c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.638] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.638] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.638] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.638] GetLastError () returned 0xea [0042.638] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.639] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\templates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.639] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.640] SetEndOfFile (hFile=0xec) returned 1 [0042.640] CloseHandle (hObject=0xec) returned 1 [0042.640] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.640] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.640] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.640] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.640] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9e656b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.640] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9e656b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.640] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.640] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="WER", cAlternateFileName="")) returned 1 [0042.641] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.641] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.641] CryptHashData (hHash=0x5c8f40, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.641] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0042.641] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.641] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.641] GetLastError () returned 0xea [0042.641] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.642] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.642] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.643] SetEndOfFile (hFile=0xec) returned 1 [0042.643] CloseHandle (hObject=0xec) returned 1 [0042.643] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.643] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.644] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.644] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.644] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9e656b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e656b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e656b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.644] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0042.644] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.645] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.645] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.645] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0042.645] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.645] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.645] GetLastError () returned 0xea [0042.645] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.645] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportarchive\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.645] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.646] SetEndOfFile (hFile=0xe8) returned 1 [0042.646] CloseHandle (hObject=0xe8) returned 1 [0042.646] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.646] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.646] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e8b810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e8b810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.647] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e8b810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e8b810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.647] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e8b810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e8b810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e8b810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.647] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e8b810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e8b810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e8b810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.647] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.647] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1 [0042.647] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.647] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.647] CryptHashData (hHash=0x5c9100, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.647] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f40) returned 1 [0042.647] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.648] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.648] GetLastError () returned 0xea [0042.648] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.648] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.648] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.649] SetEndOfFile (hFile=0xe8) returned 1 [0042.649] CloseHandle (hObject=0xe8) returned 1 [0042.649] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.649] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.649] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e8b810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e8b810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.650] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9e8b810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e8b810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.650] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xa9e8b810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e8b810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e8b810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.650] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x820, ftCreationTime.dwLowDateTime=0xa9e8b810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e8b810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e8b810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.650] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.650] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 0 [0042.650] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.650] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="WER", cAlternateFileName="")) returned 0 [0042.650] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.650] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x636e6569, dwReserved1=0x69442079, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0042.650] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.651] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.651] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.651] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.651] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.651] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.651] GetLastError () returned 0xea [0042.651] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.651] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.652] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.653] SetEndOfFile (hFile=0xf8) returned 1 [0042.653] CloseHandle (hObject=0xf8) returned 1 [0042.653] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.653] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.653] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9e8b810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e8b810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.654] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9e8b810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e8b810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.654] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1 [0042.654] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.654] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.654] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.654] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.654] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.654] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.654] GetLastError () returned 0xea [0042.654] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.655] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.664] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.665] SetEndOfFile (hFile=0xec) returned 1 [0042.665] CloseHandle (hObject=0xec) returned 1 [0042.665] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.665] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.666] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9eb1970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9eb1970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.666] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9eb1970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9eb1970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.666] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Backup", cAlternateFileName="")) returned 1 [0042.666] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.666] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.666] CryptHashData (hHash=0x5c8ec0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.666] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0042.666] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.666] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.666] GetLastError () returned 0xea [0042.667] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.667] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\backup\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.667] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.668] SetEndOfFile (hFile=0xe8) returned 1 [0042.668] CloseHandle (hObject=0xe8) returned 1 [0042.668] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.668] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.668] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9eb1970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9eb1970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.669] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9eb1970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9eb1970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.669] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9eb1970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9eb1970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9eb1970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.669] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9eb1970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9eb1970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9eb1970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.669] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.669] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9e8b810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e8b810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9eb1970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.669] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Updates", cAlternateFileName="")) returned 1 [0042.669] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.670] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.670] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.670] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0042.670] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.670] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.670] GetLastError () returned 0xea [0042.670] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.670] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\updates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.670] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.671] SetEndOfFile (hFile=0xe8) returned 1 [0042.671] CloseHandle (hObject=0xe8) returned 1 [0042.671] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.671] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.671] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9eb1970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9eb1970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.672] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9eb1970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9eb1970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.672] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9eb1970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9eb1970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9eb1970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.672] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9eb1970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9eb1970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9eb1970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.672] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.672] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", cAlternateFileName="{D2B0B~1")) returned 1 [0042.672] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.673] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.673] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.673] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0042.673] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.673] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.673] GetLastError () returned 0xea [0042.673] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.673] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.676] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.677] SetEndOfFile (hFile=0xe8) returned 1 [0042.677] CloseHandle (hObject=0xe8) returned 1 [0042.677] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.677] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.677] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.677] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.677] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9eb1970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9eb1970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.677] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fd91f9, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fd91f9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x12c4d000, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0xb17190, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="mpasbase.vdm", cAlternateFileName="")) returned 1 [0042.677] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fff35a, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x6da22700, ftLastWriteTime.dwHighDateTime=0x1cb8783, nFileSizeHigh=0x0, nFileSizeLow=0x52d90, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="mpasdlta.vdm", cAlternateFileName="")) returned 1 [0042.677] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="mpengine.dll", cAlternateFileName="")) returned 1 [0042.677] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="mpengine.dll", cAlternateFileName="")) returned 0 [0042.677] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.677] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", cAlternateFileName="{D2B0B~1")) returned 0 [0042.677] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.678] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9e8b810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9e8b810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9e8b810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2d444532, dwReserved1=0x33443434, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.678] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d444532, dwReserved1=0x33443434, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1 [0042.678] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.678] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.678] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.678] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9100) returned 1 [0042.678] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.678] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.678] GetLastError () returned 0xea [0042.678] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.679] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\localcopy\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.679] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.680] SetEndOfFile (hFile=0xec) returned 1 [0042.680] CloseHandle (hObject=0xec) returned 1 [0042.680] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.680] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.680] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.680] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.680] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ed7ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.680] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ed7ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.680] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.680] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1 [0042.681] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.681] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.681] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.681] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.681] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.681] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.681] GetLastError () returned 0xea [0042.681] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.682] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\quarantine\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.682] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.683] SetEndOfFile (hFile=0xec) returned 1 [0042.683] CloseHandle (hObject=0xec) returned 1 [0042.683] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.683] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.683] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.683] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.683] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ed7ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.683] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ed7ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.684] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.684] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Scans", cAlternateFileName="")) returned 1 [0042.684] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.684] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.684] CryptHashData (hHash=0x5c8f40, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.684] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9100) returned 1 [0042.684] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.684] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.684] GetLastError () returned 0xea [0042.684] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.685] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.685] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.686] SetEndOfFile (hFile=0xec) returned 1 [0042.686] CloseHandle (hObject=0xec) returned 1 [0042.686] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.686] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.686] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.686] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.686] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="History", cAlternateFileName="")) returned 1 [0042.686] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.687] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.687] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.687] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0042.687] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.687] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.687] GetLastError () returned 0xea [0042.687] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.687] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.703] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.704] SetEndOfFile (hFile=0xe8) returned 1 [0042.704] CloseHandle (hObject=0xe8) returned 1 [0042.704] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.704] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.704] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xa9efdc30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9efdc30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.704] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xa9efdc30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9efdc30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.704] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc0a7e0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CacheManager", cAlternateFileName="CACHEM~1")) returned 1 [0042.705] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.705] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.705] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.705] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0042.705] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.705] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.705] GetLastError () returned 0xea [0042.705] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.706] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\cachemanager\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.706] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.707] SetEndOfFile (hFile=0xf0) returned 1 [0042.707] CloseHandle (hObject=0xf0) returned 1 [0042.707] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0042.707] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.707] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0042.707] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.707] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f23d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.707] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfc0a7e0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc30940, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x33b60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MpSfc.bin", cAlternateFileName="")) returned 1 [0042.707] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfc0a7e0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xcfc0a7e0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xcfc30940, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x33b60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MpSfc.bin", cAlternateFileName="")) returned 0 [0042.707] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0042.708] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ed7ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9efdc30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.708] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa13d69d0, ftLastAccessTime.dwHighDateTime=0x1d2dda3, ftLastWriteTime.dwLowDateTime=0xa13d69d0, ftLastWriteTime.dwHighDateTime=0x1d2dda3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Results", cAlternateFileName="")) returned 1 [0042.708] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.708] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.708] CryptHashData (hHash=0x5c8f80, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.708] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f40) returned 1 [0042.708] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.708] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.708] GetLastError () returned 0xea [0042.708] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.709] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\results\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.709] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.710] SetEndOfFile (hFile=0xf0) returned 1 [0042.710] CloseHandle (hObject=0xf0) returned 1 [0042.710] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.710] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.710] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.710] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.710] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f23d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.710] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Resource", cAlternateFileName="")) returned 1 [0042.710] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0042.711] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0042.711] CryptHashData (hHash=0x5c8f80, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.711] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c91c0) returned 1 [0042.711] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0042.711] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ecd8) returned 0 [0042.711] GetLastError () returned 0xea [0042.711] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0042.711] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\results\\resource\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0042.712] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0042.713] SetEndOfFile (hFile=0x108) returned 1 [0042.713] CloseHandle (hObject=0x108) returned 1 [0042.713] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.713] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.713] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\Resource\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.713] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.713] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f23d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.713] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80be8ad0, ftCreationTime.dwHighDateTime=0x1d33740, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x81085570, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", cAlternateFileName="{1D1DB~1")) returned 1 [0042.713] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80be8ad0, ftCreationTime.dwHighDateTime=0x1d33740, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x81085570, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0}", cAlternateFileName="{1D1DB~1")) returned 0 [0042.713] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.713] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa13d69d0, ftCreationTime.dwHighDateTime=0x1d2dda3, ftLastAccessTime.dwLowDateTime=0x80be8ad0, ftLastAccessTime.dwHighDateTime=0x1d33740, ftLastWriteTime.dwLowDateTime=0x80be8ad0, ftLastWriteTime.dwHighDateTime=0x1d33740, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Resource", cAlternateFileName="")) returned 0 [0042.713] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.713] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0xb9820270, ftLastWriteTime.dwHighDateTime=0x1d2faf0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Service", cAlternateFileName="")) returned 1 [0042.713] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.714] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.714] CryptHashData (hHash=0x5c8f40, pbData=0x33e1c68, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.714] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c91c0) returned 1 [0042.714] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.714] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.714] GetLastError () returned 0xea [0042.714] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.714] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.715] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.716] SetEndOfFile (hFile=0xf0) returned 1 [0042.716] CloseHandle (hObject=0xf0) returned 1 [0042.716] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.716] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.716] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.716] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.716] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb9820270, ftCreationTime.dwHighDateTime=0x1d2faf0, ftLastAccessTime.dwLowDateTime=0xb9820270, ftLastAccessTime.dwHighDateTime=0x1d2faf0, ftLastWriteTime.dwLowDateTime=0x7de6c9b0, ftLastWriteTime.dwHighDateTime=0x1d3373d, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="History.Log", cAlternateFileName="")) returned 1 [0042.716] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f23d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.716] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadeed740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xadeed740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x2d1f02a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x1a86, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Unknown.Log", cAlternateFileName="")) returned 1 [0042.716] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadeed740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xadeed740, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x2d1f02a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x1a86, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Unknown.Log", cAlternateFileName="")) returned 0 [0042.716] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.716] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Store", cAlternateFileName="")) returned 1 [0042.716] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.717] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.717] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.717] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f40) returned 1 [0042.717] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.717] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.717] GetLastError () returned 0xea [0042.717] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.717] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\store\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.718] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.719] SetEndOfFile (hFile=0xf0) returned 1 [0042.719] CloseHandle (hObject=0xf0) returned 1 [0042.719] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.719] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.719] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.719] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.719] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f23d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.719] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f23d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.719] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.720] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Store", cAlternateFileName="")) returned 0 [0042.720] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.720] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ed7ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.720] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9ed7ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9ed7ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9ed7ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.720] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.720] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Support", cAlternateFileName="")) returned 1 [0042.720] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.720] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.720] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.720] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8ec0) returned 1 [0042.720] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.720] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.721] GetLastError () returned 0xea [0042.721] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.721] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.730] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.731] SetEndOfFile (hFile=0xec) returned 1 [0042.731] CloseHandle (hObject=0xec) returned 1 [0042.731] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.731] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.731] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.731] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f23d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.731] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f23d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f23d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f49ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.731] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x798d48a0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x30ada, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 1 [0042.731] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x798d48a0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x30ada, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 0 [0042.731] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.731] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Support", cAlternateFileName="")) returned 0 [0042.731] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.731] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0042.731] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.732] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.732] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.732] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8ec0) returned 1 [0042.732] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.732] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.732] GetLastError () returned 0xea [0042.732] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.732] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.733] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.734] SetEndOfFile (hFile=0xf8) returned 1 [0042.734] CloseHandle (hObject=0xf8) returned 1 [0042.734] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.734] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.734] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f49ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f49ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.734] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f49ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f49ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.734] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f49ef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f49ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f49ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.734] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSFax", cAlternateFileName="")) returned 1 [0042.734] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.735] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.735] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.735] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9100) returned 1 [0042.735] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.735] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.735] GetLastError () returned 0xea [0042.735] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.735] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.736] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.737] SetEndOfFile (hFile=0xec) returned 1 [0042.737] CloseHandle (hObject=0xec) returned 1 [0042.737] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.737] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.737] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f49ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f49ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.737] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f49ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f49ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.737] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ActivityLog", cAlternateFileName="ACTIVI~1")) returned 1 [0042.737] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.738] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.738] CryptHashData (hHash=0x5c90c0, pbData=0x1fe5350, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.738] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f40) returned 1 [0042.738] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.738] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.738] GetLastError () returned 0xea [0042.738] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.738] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\activitylog\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.739] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.740] SetEndOfFile (hFile=0xe8) returned 1 [0042.742] CloseHandle (hObject=0xe8) returned 1 [0042.742] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.742] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.742] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f70050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f70050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.742] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f70050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f70050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.742] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f70050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f70050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f70050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.742] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f70050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f70050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f70050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.742] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.742] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Common Coverpages", cAlternateFileName="COMMON~1")) returned 1 [0042.742] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.743] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.743] CryptHashData (hHash=0x5c8f40, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.743] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0042.743] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.743] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.743] GetLastError () returned 0xea [0042.743] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.743] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.744] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.745] SetEndOfFile (hFile=0xe8) returned 1 [0042.745] CloseHandle (hObject=0xe8) returned 1 [0042.745] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.745] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.745] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f70050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f70050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.745] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f70050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f70050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.746] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0042.746] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.746] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.746] CryptHashData (hHash=0x5c8f40, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.746] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c91c0) returned 1 [0042.746] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.746] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.746] GetLastError () returned 0xea [0042.746] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.747] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.747] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.748] SetEndOfFile (hFile=0xf0) returned 1 [0042.748] CloseHandle (hObject=0xf0) returned 1 [0042.748] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.748] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.748] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa9f70050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f70050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.748] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa9f70050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f70050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.748] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="confident.cov", cAlternateFileName="")) returned 1 [0042.748] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fyi.cov", cAlternateFileName="")) returned 1 [0042.748] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="generic.cov", cAlternateFileName="")) returned 1 [0042.748] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f70050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f70050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f70050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.748] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="urgent.cov", cAlternateFileName="")) returned 1 [0042.749] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="urgent.cov", cAlternateFileName="")) returned 0 [0042.749] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.749] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f70050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f70050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f70050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.749] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f70050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f70050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f70050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.749] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.749] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f49ef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f49ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f70050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.749] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Inbox", cAlternateFileName="")) returned 1 [0042.749] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.749] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.749] CryptHashData (hHash=0x5c90c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.749] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c91c0) returned 1 [0042.749] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.749] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.749] GetLastError () returned 0xea [0042.750] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.750] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\inbox\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.754] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.754] SetEndOfFile (hFile=0xe8) returned 1 [0042.755] CloseHandle (hObject=0xe8) returned 1 [0042.755] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.755] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.755] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f961b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.755] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f961b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.755] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.755] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Queue", cAlternateFileName="")) returned 1 [0042.755] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.756] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.756] CryptHashData (hHash=0x5c91c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.756] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0042.756] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.756] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.756] GetLastError () returned 0xea [0042.756] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.756] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\queue\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.757] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.757] SetEndOfFile (hFile=0xe8) returned 1 [0042.757] CloseHandle (hObject=0xe8) returned 1 [0042.758] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.758] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.758] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.758] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.758] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f961b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.758] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f961b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.758] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.758] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="SentItems", cAlternateFileName="SENTIT~1")) returned 1 [0042.758] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.759] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.759] CryptHashData (hHash=0x5c90c0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.759] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c91c0) returned 1 [0042.759] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.759] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.759] GetLastError () returned 0xea [0042.759] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.759] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\sentitems\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.759] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.760] SetEndOfFile (hFile=0xe8) returned 1 [0042.760] CloseHandle (hObject=0xe8) returned 1 [0042.760] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.760] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.761] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.761] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.761] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f961b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.761] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f961b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.761] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.761] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 1 [0042.761] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.761] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.762] CryptHashData (hHash=0x5c91c0, pbData=0x1fe5350, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.762] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0042.762] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.762] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.762] GetLastError () returned 0xea [0042.762] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.762] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.762] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.763] SetEndOfFile (hFile=0xe8) returned 1 [0042.763] CloseHandle (hObject=0xe8) returned 1 [0042.763] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.763] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.763] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.764] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.764] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0042.764] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.764] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.764] CryptHashData (hHash=0x5c91c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.764] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f40) returned 1 [0042.764] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.764] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.764] GetLastError () returned 0xea [0042.764] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.765] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.765] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.766] SetEndOfFile (hFile=0xf0) returned 1 [0042.766] CloseHandle (hObject=0xf0) returned 1 [0042.766] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.766] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.766] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.766] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.766] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f961b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.766] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 1 [0042.766] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0 [0042.767] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.767] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f961b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20666974, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.767] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f961b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x20666974, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.767] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.767] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 0 [0042.767] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.767] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6413bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6413bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20455278, dwReserved1=0x52434e45, cFileName="MSScan", cAlternateFileName="")) returned 1 [0042.767] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.767] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.767] CryptHashData (hHash=0x5c9100, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.767] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0042.767] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.768] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.768] GetLastError () returned 0xea [0042.768] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.768] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.782] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.783] SetEndOfFile (hFile=0xec) returned 1 [0042.783] CloseHandle (hObject=0xec) returned 1 [0042.783] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.783] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.783] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.784] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9f961b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.785] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9f961b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9f961b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9fbc310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.785] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1 [0042.785] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6413bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6413bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6485fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WelcomeScan.jpg.crypt", cAlternateFileName="WELCOM~1.CRY")) returned 1 [0042.785] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6413bb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6413bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6485fd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WelcomeScan.jpg.crypt", cAlternateFileName="WELCOM~1.CRY")) returned 0 [0042.785] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.785] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6413bb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6413bb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20455278, dwReserved1=0x52434e45, cFileName="MSScan", cAlternateFileName="")) returned 0 [0042.785] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.785] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0042.785] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.785] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.785] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.785] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.785] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.786] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.786] GetLastError () returned 0xea [0042.786] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.786] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.786] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.787] SetEndOfFile (hFile=0xf8) returned 1 [0042.787] CloseHandle (hObject=0xf8) returned 1 [0042.787] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.787] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.787] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9fe2470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9fe2470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.788] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa9fe2470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9fe2470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.788] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9fe2470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9fe2470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9fe2470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.788] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Profiles", cAlternateFileName="")) returned 1 [0042.788] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.788] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.788] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.788] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9100) returned 1 [0042.788] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.788] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.788] GetLastError () returned 0xea [0042.788] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.789] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\profiles\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0042.789] WriteFile (in: hFile=0xffffffff, lpBuffer=0x33b8a14, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0) returned 0 [0042.789] SetEndOfFile (hFile=0xffffffff) returned 0 [0042.789] CloseHandle (hObject=0xffffffff) returned 0 [0042.789] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.789] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.789] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc0000022, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.789] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc0000022, cFileName="..", cAlternateFileName="")) returned 1 [0042.789] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xc0000022, cFileName="..", cAlternateFileName="")) returned 0 [0042.789] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.789] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Profiles", cAlternateFileName="")) returned 0 [0042.789] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.790] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0042.790] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.790] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65646e65, dwReserved1=0x72757472, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0042.790] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.790] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.790] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.790] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0042.790] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.790] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f8e0) returned 0 [0042.790] GetLastError () returned 0xea [0042.790] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.791] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft Help\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\microsoft help\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.792] WriteFile (in: hFile=0xdc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.793] SetEndOfFile (hFile=0xdc) returned 1 [0042.793] CloseHandle (hObject=0xdc) returned 1 [0042.793] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.793] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.793] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xa9fe2470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9fe2470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.793] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xa9fe2470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9fe2470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.793] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9fe2470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9fe2470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9fe2470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.793] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x896b9210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x896b9210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Hx.hxn", cAlternateFileName="")) returned 1 [0042.793] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.EXCEL.14.1033.hxn", cAlternateFileName="MSEXCE~1.HXN")) returned 1 [0042.793] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.EXCEL.DEV.14.1033.hxn", cAlternateFileName="MSEXCE~2.HXN")) returned 1 [0042.793] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.GRAPH.14.1033.hxn", cAlternateFileName="MSGRAP~1.HXN")) returned 1 [0042.793] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd822070, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.GROOVE.14.1033.hxn", cAlternateFileName="MSGROO~1.HXN")) returned 1 [0042.793] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11446a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.INFOPATH.14.1033.hxn", cAlternateFileName="MSINFO~1.HXN")) returned 1 [0042.793] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1146cbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.INFOPATHEDITOR.14.1033.hxn", cAlternateFileName="MSINFO~2.HXN")) returned 1 [0042.793] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.MSACCESS.14.1033.hxn", cAlternateFileName="MSMSAC~1.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.MSACCESS.DEV.14.1033.hxn", cAlternateFileName="MSMSAC~2.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.MSOUC.14.1033.hxn", cAlternateFileName="MSMSOU~1.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.MSPUB.14.1033.hxn", cAlternateFileName="MSMSPU~1.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.MSPUB.DEV.14.1033.hxn", cAlternateFileName="MSMSPU~2.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.MSTORE.14.1033.hxn", cAlternateFileName="MSMSTO~1.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.OIS.14.1033.hxn", cAlternateFileName="MSOIS1~1.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e3ad0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.ONENOTE.14.1033.hxn", cAlternateFileName="MSONEN~1.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2689510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.OUTLOOK.14.1033.hxn", cAlternateFileName="MSOUTL~1.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26af670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.OUTLOOK.DEV.14.1033.hxn", cAlternateFileName="MSOUTL~2.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.POWERPNT.14.1033.hxn", cAlternateFileName="MSPOWE~1.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.POWERPNT.DEV.14.1033.hxn", cAlternateFileName="MSPOWE~2.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.SETLANG.14.1033.hxn", cAlternateFileName="MSSETL~1.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5269fec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.VISIO.14.1033.hxn", cAlternateFileName="MSVISI~1.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.VISIO.DEV.14.1033.hxn", cAlternateFileName="MSVISI~3.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn", cAlternateFileName="MSVISI~4.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.VISIO_PRM.14.1033.hxn", cAlternateFileName="MSE1C9~1.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.VISIO_STD.14.1033.hxn", cAlternateFileName="MSVISI~2.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.WINPROJ.14.1033.hxn", cAlternateFileName="MSWINP~1.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.WINPROJ.DEV.14.1033.hxn", cAlternateFileName="MSWINP~2.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.WINWORD.14.1033.hxn", cAlternateFileName="MSWINW~1.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MS.WINWORD.DEV.14.1033.hxn", cAlternateFileName="MSWINW~2.HXN")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="nslist.hxl", cAlternateFileName="")) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="nslist.hxl", cAlternateFileName="")) returned 0 [0042.794] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.794] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e564544, dwReserved1=0x312e3431, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0042.794] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.795] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.795] CryptHashData (hHash=0x5c90c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.795] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8fc0) returned 1 [0042.795] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.795] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f8e0) returned 0 [0042.795] GetLastError () returned 0xea [0042.795] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.795] CreateFileA (lpFileName="C:\\Users\\All Users\\Mozilla\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\mozilla\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.796] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.797] SetEndOfFile (hFile=0xdc) returned 1 [0042.797] CloseHandle (hObject=0xdc) returned 1 [0042.797] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.797] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.797] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa9fe2470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9fe2470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.797] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa9fe2470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9fe2470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.797] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9fe2470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9fe2470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9fe2470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.797] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="logs", cAlternateFileName="")) returned 1 [0042.797] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.798] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.798] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.798] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9100) returned 1 [0042.798] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.798] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.798] GetLastError () returned 0xea [0042.798] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.798] CreateFileA (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\mozilla\\logs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.799] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.800] SetEndOfFile (hFile=0xf8) returned 1 [0042.800] CloseHandle (hObject=0xf8) returned 1 [0042.800] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.800] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.800] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa9fe2470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9fe2470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.800] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa9fe2470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9fe2470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.800] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa9fe2470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9fe2470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.800] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 1 [0042.800] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb07822e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0xa4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="maintenanceservice-install.log", cAlternateFileName="MAINTE~1.LOG")) returned 0 [0042.800] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.800] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="logs", cAlternateFileName="")) returned 0 [0042.800] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.800] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Oracle", cAlternateFileName="")) returned 1 [0042.800] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.801] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.801] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.801] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c9100) returned 1 [0042.801] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.801] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f8e0) returned 0 [0042.801] GetLastError () returned 0xea [0042.801] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.801] CreateFileA (lpFileName="C:\\Users\\All Users\\Oracle\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\oracle\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.802] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.803] SetEndOfFile (hFile=0xdc) returned 1 [0042.803] CloseHandle (hObject=0xdc) returned 1 [0042.803] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.803] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.803] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.803] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.803] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa0085d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.803] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa0085d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0042.803] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.803] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0042.803] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.804] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.804] CryptHashData (hHash=0x5c9100, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.804] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8fc0) returned 1 [0042.804] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.804] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f8e0) returned 0 [0042.804] GetLastError () returned 0xea [0042.804] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.804] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.805] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.806] SetEndOfFile (hFile=0xdc) returned 1 [0042.806] CloseHandle (hObject=0xdc) returned 1 [0042.806] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.807] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.807] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0042.807] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.807] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="42D5BEC7DDFBD49E76467529CBC2868987BF8460", cAlternateFileName="42D5BE~1")) returned 1 [0042.807] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.807] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.807] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.807] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0042.807] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.807] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.807] GetLastError () returned 0xea [0042.808] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.808] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.808] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.809] SetEndOfFile (hFile=0xf8) returned 1 [0042.809] CloseHandle (hObject=0xf8) returned 1 [0042.809] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0042.809] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.809] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0042.809] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.810] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0085d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.810] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.810] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.810] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.810] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.810] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8ec0) returned 1 [0042.810] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.810] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.810] GetLastError () returned 0xea [0042.810] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.811] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.811] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.812] SetEndOfFile (hFile=0xec) returned 1 [0042.812] CloseHandle (hObject=0xec) returned 1 [0042.812] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.812] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.812] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.812] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.812] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0085d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.812] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Patch", cAlternateFileName="")) returned 1 [0042.812] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.813] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.813] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.813] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f40) returned 1 [0042.813] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.813] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.813] GetLastError () returned 0xea [0042.813] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.813] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.814] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.815] SetEndOfFile (hFile=0xe8) returned 1 [0042.815] CloseHandle (hObject=0xe8) returned 1 [0042.815] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.815] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.815] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.815] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.815] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0085d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.815] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="x64", cAlternateFileName="")) returned 1 [0042.815] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.816] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.816] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.816] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c91c0) returned 1 [0042.816] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.816] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.816] GetLastError () returned 0xea [0042.816] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.816] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.817] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.818] SetEndOfFile (hFile=0xf0) returned 1 [0042.818] CloseHandle (hObject=0xf0) returned 1 [0042.818] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.818] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.818] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.818] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.818] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa02e730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.818] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0042.818] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59d2100, ftCreationTime.dwHighDateTime=0x1d0a100, ftLastAccessTime.dwLowDateTime=0x59d2100, ftLastAccessTime.dwHighDateTime=0x1d0a100, ftLastWriteTime.dwLowDateTime=0x59d2100, ftLastWriteTime.dwHighDateTime=0x1d0a100, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0 [0042.818] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.818] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="x64", cAlternateFileName="")) returned 0 [0042.818] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.818] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Patch", cAlternateFileName="")) returned 0 [0042.818] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.818] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.819] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0042.819] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0042.819] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.819] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.819] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.819] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8ec0) returned 1 [0042.819] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.819] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.819] GetLastError () returned 0xea [0042.819] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.820] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.820] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.821] SetEndOfFile (hFile=0xf8) returned 1 [0042.821] CloseHandle (hObject=0xf8) returned 1 [0042.821] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.821] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.821] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.821] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.821] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa02e730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.821] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.821] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.822] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.822] CryptHashData (hHash=0x5c90c0, pbData=0x33e1ca4, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.822] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.822] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.822] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.822] GetLastError () returned 0xea [0042.822] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.822] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.823] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.824] SetEndOfFile (hFile=0xec) returned 1 [0042.824] CloseHandle (hObject=0xec) returned 1 [0042.824] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.824] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.824] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.824] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.824] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa02e730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.824] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Patch", cAlternateFileName="")) returned 1 [0042.824] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.825] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.825] CryptHashData (hHash=0x5c90c0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.825] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c91c0) returned 1 [0042.825] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.825] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.825] GetLastError () returned 0xea [0042.825] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.825] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.826] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.827] SetEndOfFile (hFile=0xe8) returned 1 [0042.827] CloseHandle (hObject=0xe8) returned 1 [0042.827] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.827] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.827] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.827] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.827] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa02e730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.827] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="x64", cAlternateFileName="")) returned 1 [0042.827] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0042.828] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0042.828] CryptHashData (hHash=0x5c90c0, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.828] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9100) returned 1 [0042.828] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0042.828] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18ef40) returned 0 [0042.828] GetLastError () returned 0xea [0042.828] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0042.828] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0042.829] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0042.829] SetEndOfFile (hFile=0xf0) returned 1 [0042.830] CloseHandle (hObject=0xf0) returned 1 [0042.830] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.830] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.830] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.830] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.830] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa02e730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa02e730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa02e730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.830] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0042.830] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0 [0042.830] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.830] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="x64", cAlternateFileName="")) returned 0 [0042.830] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.830] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Patch", cAlternateFileName="")) returned 0 [0042.830] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.830] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.830] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.830] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa0085d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0085d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0085d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.830] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0042.830] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.831] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.831] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.831] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0042.831] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.831] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.831] GetLastError () returned 0xea [0042.831] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.832] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.832] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.833] SetEndOfFile (hFile=0xf8) returned 1 [0042.833] CloseHandle (hObject=0xf8) returned 1 [0042.833] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.833] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.833] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa054890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa054890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.833] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa054890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa054890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.833] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa054890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa054890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa054890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.833] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.833] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.834] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.834] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.834] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c91c0) returned 1 [0042.834] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.834] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.834] GetLastError () returned 0xea [0042.834] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.834] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.835] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.836] SetEndOfFile (hFile=0xec) returned 1 [0042.836] CloseHandle (hObject=0xec) returned 1 [0042.836] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.836] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.836] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa054890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa054890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.836] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa054890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa054890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.836] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa054890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa054890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa054890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.836] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0042.836] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.837] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.837] CryptHashData (hHash=0x5c8ec0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.837] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0042.837] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.837] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.837] GetLastError () returned 0xea [0042.837] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.837] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.839] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.840] SetEndOfFile (hFile=0xe8) returned 1 [0042.840] CloseHandle (hObject=0xe8) returned 1 [0042.840] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.840] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.840] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa054890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa054890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.840] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa054890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa054890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.840] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0042.840] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa054890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa054890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa054890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.840] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0042.840] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc6500, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x50cc6500, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x50cc6500, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0042.840] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.841] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0042.841] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.841] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.841] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.841] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0042.841] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.841] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.841] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.841] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c91c0) returned 1 [0042.841] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.841] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.841] GetLastError () returned 0xea [0042.841] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.842] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.843] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.844] SetEndOfFile (hFile=0xf8) returned 1 [0042.844] CloseHandle (hObject=0xf8) returned 1 [0042.844] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.844] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.844] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa054890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa054890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.845] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa054890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa054890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.845] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa054890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa054890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa054890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.845] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd314a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf08b3aa0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0042.845] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0042.845] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0042.845] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.845] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e36, dwReserved1=0x52434e65, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0042.845] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.845] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.845] CryptHashData (hHash=0x5c91c0, pbData=0x1fe5350, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.845] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0042.846] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.846] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.846] GetLastError () returned 0xea [0042.846] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.846] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.846] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.847] SetEndOfFile (hFile=0xf8) returned 1 [0042.848] CloseHandle (hObject=0xf8) returned 1 [0042.848] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.848] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.848] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.848] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.848] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa07a9f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.848] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.848] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.849] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.849] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.849] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9100) returned 1 [0042.849] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.849] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.849] GetLastError () returned 0xea [0042.849] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.849] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.849] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.850] SetEndOfFile (hFile=0xec) returned 1 [0042.850] CloseHandle (hObject=0xec) returned 1 [0042.850] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.850] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.850] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.851] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.851] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa07a9f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.851] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0042.851] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.851] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.851] CryptHashData (hHash=0x5c91c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.851] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0042.851] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.852] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.852] GetLastError () returned 0xea [0042.852] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.852] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.854] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.855] SetEndOfFile (hFile=0xe8) returned 1 [0042.855] CloseHandle (hObject=0xe8) returned 1 [0042.855] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.855] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.855] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.855] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.855] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87bcb00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0xa87bcb00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0xa87bcb00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0042.855] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa07a9f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.855] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0042.855] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0042.855] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.855] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0042.855] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.855] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.855] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.856] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0042.856] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.856] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.856] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.856] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9100) returned 1 [0042.856] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.856] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.856] GetLastError () returned 0xea [0042.856] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.857] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.858] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.859] SetEndOfFile (hFile=0xf8) returned 1 [0042.859] CloseHandle (hObject=0xf8) returned 1 [0042.859] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.859] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.859] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.859] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.859] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa07a9f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.859] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a127460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1c821ca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0042.859] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0042.859] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0042.860] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.860] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x52434e65, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0042.860] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.860] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.860] CryptHashData (hHash=0x5c9100, pbData=0x1fe5350, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.860] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0042.860] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.860] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.860] GetLastError () returned 0xea [0042.860] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.861] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.861] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.862] SetEndOfFile (hFile=0xf8) returned 1 [0042.862] CloseHandle (hObject=0xf8) returned 1 [0042.862] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.862] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.862] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.863] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa07a9f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.863] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa07a9f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa07a9f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0a0b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.863] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.863] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.863] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.863] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.863] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8ec0) returned 1 [0042.863] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.863] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.863] GetLastError () returned 0xea [0042.863] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.864] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.864] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.865] SetEndOfFile (hFile=0xec) returned 1 [0042.865] CloseHandle (hObject=0xec) returned 1 [0042.865] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.865] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.865] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa0a0b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0a0b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.865] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa0a0b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0a0b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.865] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0a0b50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0a0b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0a0b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.865] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0042.865] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.866] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.866] CryptHashData (hHash=0x5c9100, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.866] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c91c0) returned 1 [0042.866] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.866] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.866] GetLastError () returned 0xea [0042.866] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.867] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.870] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.871] SetEndOfFile (hFile=0xe8) returned 1 [0042.871] CloseHandle (hObject=0xe8) returned 1 [0042.871] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.871] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.871] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa0a0b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0a0b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.871] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa0a0b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0a0b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.871] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15e8b00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd15e8b00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd15e8b00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0042.871] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0a0b50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0a0b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0a0b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.872] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0042.872] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0042.872] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.872] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0042.872] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.872] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.872] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.872] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0042.872] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.872] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.872] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.873] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8ec0) returned 1 [0042.873] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.873] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.873] GetLastError () returned 0xea [0042.873] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.873] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.873] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.874] SetEndOfFile (hFile=0xf8) returned 1 [0042.874] CloseHandle (hObject=0xf8) returned 1 [0042.874] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.874] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.874] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa0a0b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0a0b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.875] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa0a0b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0a0b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.875] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0a0b50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0a0b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0a0b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.875] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.875] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.875] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.875] CryptHashData (hHash=0x5c8f40, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.875] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c91c0) returned 1 [0042.875] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.875] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.875] GetLastError () returned 0xea [0042.875] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.876] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.876] WriteFile (in: hFile=0xec, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.877] SetEndOfFile (hFile=0xec) returned 1 [0042.877] CloseHandle (hObject=0xec) returned 1 [0042.879] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.879] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.879] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa0a0b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0a0b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.880] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa0a0b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0a0b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.880] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0a0b50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0a0b50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0a0b50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.880] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0042.880] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.880] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.880] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.880] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0042.880] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.880] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.880] GetLastError () returned 0xea [0042.881] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.881] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.882] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.883] SetEndOfFile (hFile=0xe8) returned 1 [0042.883] CloseHandle (hObject=0xe8) returned 1 [0042.884] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.884] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.884] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa0c6cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0c6cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.884] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa0c6cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0c6cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.884] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0042.884] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0c6cb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0c6cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0c6cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.884] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0042.884] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0042.884] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.884] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0042.884] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.884] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.884] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.884] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0042.884] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.885] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.885] CryptHashData (hHash=0x5c8ec0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.885] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c91c0) returned 1 [0042.885] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.885] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.885] GetLastError () returned 0xea [0042.885] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.885] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.886] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.888] SetEndOfFile (hFile=0xf8) returned 1 [0042.888] CloseHandle (hObject=0xf8) returned 1 [0042.888] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.888] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.888] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa0c6cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0c6cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.889] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa0c6cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0c6cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.889] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0c6cb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0c6cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0c6cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.889] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.889] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.889] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.889] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.889] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9100) returned 1 [0042.889] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.889] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.889] GetLastError () returned 0xea [0042.889] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.890] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.890] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.891] SetEndOfFile (hFile=0xec) returned 1 [0042.891] CloseHandle (hObject=0xec) returned 1 [0042.891] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.891] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.891] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa0c6cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0c6cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.892] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa0c6cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0c6cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.892] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0c6cb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0c6cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0c6cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.892] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0042.892] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.892] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.892] CryptHashData (hHash=0x5c8ec0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.892] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f40) returned 1 [0042.892] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.892] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.892] GetLastError () returned 0xea [0042.892] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.893] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.895] WriteFile (in: hFile=0xe8, lpBuffer=0x33e1cb8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33e1cb8*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.895] SetEndOfFile (hFile=0xe8) returned 1 [0042.896] CloseHandle (hObject=0xe8) returned 1 [0042.896] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.896] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.896] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.896] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.896] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0042.896] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0ece10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.896] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0042.896] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0042.896] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.896] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0042.896] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.896] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.896] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.896] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0042.896] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.897] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.897] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.897] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9100) returned 1 [0042.897] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.897] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.897] GetLastError () returned 0xea [0042.897] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.897] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.898] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.899] SetEndOfFile (hFile=0xf8) returned 1 [0042.899] CloseHandle (hObject=0xf8) returned 1 [0042.899] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.899] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.899] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.899] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.899] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0ece10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.899] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.899] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.900] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.900] CryptHashData (hHash=0x5c91c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.900] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.900] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.900] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.900] GetLastError () returned 0xea [0042.900] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.900] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.901] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.901] SetEndOfFile (hFile=0xec) returned 1 [0042.902] CloseHandle (hObject=0xec) returned 1 [0042.902] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.902] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.902] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.902] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.902] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0ece10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.902] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0042.902] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.902] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.902] CryptHashData (hHash=0x5c91c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.903] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0042.903] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.903] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.903] GetLastError () returned 0xea [0042.903] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.903] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.905] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.906] SetEndOfFile (hFile=0xe8) returned 1 [0042.906] CloseHandle (hObject=0xe8) returned 1 [0042.906] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.906] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.906] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.906] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.906] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9b1b00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7c9b1b00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7c9b1b00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0042.906] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0ece10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.906] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0042.906] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0042.906] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.906] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0042.906] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.906] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.906] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.906] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0042.906] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.907] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.907] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.907] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0042.907] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.907] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.907] GetLastError () returned 0xea [0042.907] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.907] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.908] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.909] SetEndOfFile (hFile=0xf8) returned 1 [0042.909] CloseHandle (hObject=0xf8) returned 1 [0042.909] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.909] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.909] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.909] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa0ece10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.909] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0ece10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa0ece10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa112f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.909] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.909] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.910] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.910] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.910] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8ec0) returned 1 [0042.910] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.910] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.910] GetLastError () returned 0xea [0042.910] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.910] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.911] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.912] SetEndOfFile (hFile=0xec) returned 1 [0042.912] CloseHandle (hObject=0xec) returned 1 [0042.912] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.912] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.912] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa112f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa112f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.912] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa112f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa112f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.912] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa112f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa112f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa112f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.912] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0042.912] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.913] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.913] CryptHashData (hHash=0x5c9100, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.913] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c91c0) returned 1 [0042.913] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.913] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.913] GetLastError () returned 0xea [0042.913] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.913] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.915] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.916] SetEndOfFile (hFile=0xe8) returned 1 [0042.916] CloseHandle (hObject=0xe8) returned 1 [0042.916] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.916] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.916] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa112f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa112f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.916] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa112f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa112f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.916] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b69ee00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7b69ee00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7b69ee00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0042.916] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa112f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa112f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa112f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.916] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0042.917] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0042.917] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.917] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0042.917] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.917] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.917] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.917] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0042.917] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.917] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.917] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.917] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8ec0) returned 1 [0042.918] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.918] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.918] GetLastError () returned 0xea [0042.918] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.918] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.918] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.919] SetEndOfFile (hFile=0xf8) returned 1 [0042.919] CloseHandle (hObject=0xf8) returned 1 [0042.919] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.919] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.919] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa112f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa112f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.920] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa112f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa112f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.920] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa112f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa112f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa112f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.920] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.920] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.920] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.920] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.920] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c91c0) returned 1 [0042.920] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.920] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.920] GetLastError () returned 0xea [0042.920] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.921] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.921] WriteFile (in: hFile=0xec, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.922] SetEndOfFile (hFile=0xec) returned 1 [0042.922] CloseHandle (hObject=0xec) returned 1 [0042.922] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.922] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.922] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa112f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa112f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.922] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa112f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa112f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.922] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa112f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa112f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa112f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.922] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0042.922] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.923] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.923] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.923] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0042.923] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.923] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.923] GetLastError () returned 0xea [0042.923] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.923] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.925] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.926] SetEndOfFile (hFile=0xe8) returned 1 [0042.926] CloseHandle (hObject=0xe8) returned 1 [0042.926] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.926] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.926] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.927] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.927] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aae6600, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x8aae6600, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x8aae6600, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0042.927] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa112f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa112f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.927] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0042.927] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0042.927] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.927] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0042.927] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.927] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.927] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.927] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0042.927] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.928] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.928] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.928] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c91c0) returned 1 [0042.928] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.928] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.928] GetLastError () returned 0xea [0042.928] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.928] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.928] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.929] SetEndOfFile (hFile=0xf8) returned 1 [0042.929] CloseHandle (hObject=0xf8) returned 1 [0042.929] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.929] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.929] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.930] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.930] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1390d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.930] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.930] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.930] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.930] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.930] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9100) returned 1 [0042.930] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.930] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.930] GetLastError () returned 0xea [0042.931] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.931] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.931] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.932] SetEndOfFile (hFile=0xec) returned 1 [0042.932] CloseHandle (hObject=0xec) returned 1 [0042.932] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.932] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.932] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.933] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.933] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1390d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.933] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0042.933] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.933] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.933] CryptHashData (hHash=0x5c8ec0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.933] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f40) returned 1 [0042.933] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.933] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.934] GetLastError () returned 0xea [0042.934] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.934] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.936] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.936] SetEndOfFile (hFile=0xe8) returned 1 [0042.937] CloseHandle (hObject=0xe8) returned 1 [0042.937] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.937] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.937] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.937] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.937] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x884c0c00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x884c0c00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x884c0c00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0042.937] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1390d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.937] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0042.937] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0042.937] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.937] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0042.937] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.937] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.937] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.937] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0042.937] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.938] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.938] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.938] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9100) returned 1 [0042.938] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.938] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.938] GetLastError () returned 0xea [0042.938] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.938] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.940] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.941] SetEndOfFile (hFile=0xf8) returned 1 [0042.941] CloseHandle (hObject=0xf8) returned 1 [0042.941] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.941] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.941] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.941] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1390d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.941] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1390d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1390d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa15f230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.941] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfe3882c0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0042.941] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0042.941] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0042.941] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.941] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x52434e65, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0042.941] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.942] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.942] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.942] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c91c0) returned 1 [0042.942] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.942] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.942] GetLastError () returned 0xea [0042.942] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.942] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.943] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.944] SetEndOfFile (hFile=0xf8) returned 1 [0042.944] CloseHandle (hObject=0xf8) returned 1 [0042.944] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.944] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.944] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa15f230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa15f230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.944] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa15f230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa15f230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.944] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa15f230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa15f230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa15f230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.944] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.944] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.945] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.945] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.945] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8f40) returned 1 [0042.945] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.945] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.945] GetLastError () returned 0xea [0042.945] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.945] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.946] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.947] SetEndOfFile (hFile=0xec) returned 1 [0042.947] CloseHandle (hObject=0xec) returned 1 [0042.947] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.947] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.947] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa15f230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa15f230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.947] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa15f230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa15f230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.947] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa15f230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa15f230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa15f230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.947] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0042.947] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.948] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.948] CryptHashData (hHash=0x5c9100, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.948] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0042.948] CryptDestroyHash (hHash=0x5c9100) returned 1 [0042.948] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.948] GetLastError () returned 0xea [0042.948] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.948] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.952] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.953] SetEndOfFile (hFile=0xe8) returned 1 [0042.953] CloseHandle (hObject=0xe8) returned 1 [0042.953] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.953] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.953] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa15f230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa15f230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.953] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xaa15f230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa15f230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.954] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969a2800, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x969a2800, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x969a2800, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0042.954] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa15f230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa15f230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa15f230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.954] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0042.954] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0042.954] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.954] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0042.954] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.954] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.954] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.954] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0042.954] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.955] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.955] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.955] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0042.955] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.955] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.955] GetLastError () returned 0xea [0042.955] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.955] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.956] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.957] SetEndOfFile (hFile=0xf8) returned 1 [0042.957] CloseHandle (hObject=0xf8) returned 1 [0042.957] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.957] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.957] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa15f230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa15f230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.957] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa15f230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa15f230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.957] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa15f230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa15f230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa185390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.957] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.957] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.958] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.958] CryptHashData (hHash=0x5c91c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.958] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8ec0) returned 1 [0042.958] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.958] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.958] GetLastError () returned 0xea [0042.958] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.958] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.959] WriteFile (in: hFile=0xec, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.960] SetEndOfFile (hFile=0xec) returned 1 [0042.960] CloseHandle (hObject=0xec) returned 1 [0042.960] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.960] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.960] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa185390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa185390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.960] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa185390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa185390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.960] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa185390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa185390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa185390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.960] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0042.960] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.961] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.961] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.961] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9100) returned 1 [0042.961] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0042.961] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.961] GetLastError () returned 0xea [0042.961] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.961] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.963] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.964] SetEndOfFile (hFile=0xe8) returned 1 [0042.964] CloseHandle (hObject=0xe8) returned 1 [0042.964] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.964] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.964] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa185390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa185390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.964] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa185390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa185390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.964] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7f300, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xdae7f300, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xdae7f300, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0042.964] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa185390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa185390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa185390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.964] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0042.964] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0042.964] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.964] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0042.964] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.964] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.964] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.965] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0042.965] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.965] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.965] CryptHashData (hHash=0x5c8f40, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.965] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8ec0) returned 1 [0042.965] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.965] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.965] GetLastError () returned 0xea [0042.965] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.966] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.967] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.968] SetEndOfFile (hFile=0xf8) returned 1 [0042.968] CloseHandle (hObject=0xf8) returned 1 [0042.968] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.968] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.968] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa185390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa185390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.969] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xaa185390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa185390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.969] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa185390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa185390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa185390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.969] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xe9f9cff0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0042.969] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0042.969] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0042.969] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.969] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3436, dwReserved1=0x52436578, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0042.969] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.969] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.969] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.969] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0042.969] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.969] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.970] GetLastError () returned 0xea [0042.970] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.970] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.972] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.973] SetEndOfFile (hFile=0xf8) returned 1 [0042.973] CloseHandle (hObject=0xf8) returned 1 [0042.973] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.973] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.973] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.973] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.973] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa185390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa185390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.973] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad7040, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x105e7220, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0042.973] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0042.973] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0042.973] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.973] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e36, dwReserved1=0x52434e65, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0042.973] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.974] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.974] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.974] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8ec0) returned 1 [0042.974] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.974] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.974] GetLastError () returned 0xea [0042.974] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.974] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.976] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.977] SetEndOfFile (hFile=0xf8) returned 1 [0042.977] CloseHandle (hObject=0xf8) returned 1 [0042.977] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0042.977] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.977] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0042.977] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.977] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1ab4f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.977] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93efac0, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6601040, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0042.977] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0042.978] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0042.978] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0042.978] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3638, dwReserved1=0x52436578, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0042.978] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.978] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.978] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.978] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0042.978] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.978] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.978] GetLastError () returned 0xea [0042.978] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.979] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.979] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.980] SetEndOfFile (hFile=0xf8) returned 1 [0042.980] CloseHandle (hObject=0xf8) returned 1 [0042.980] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.980] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.980] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.980] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.980] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1ab4f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.980] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 1 [0042.980] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.981] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.981] CryptHashData (hHash=0x5c8ec0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.981] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9100) returned 1 [0042.981] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.981] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.981] GetLastError () returned 0xea [0042.981] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.981] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.982] WriteFile (in: hFile=0xec, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.983] SetEndOfFile (hFile=0xec) returned 1 [0042.983] CloseHandle (hObject=0xec) returned 1 [0042.983] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.983] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.983] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.983] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.983] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1ab4f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.983] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0042.983] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0042.984] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0042.984] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.984] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c91c0) returned 1 [0042.984] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0042.984] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f1a8) returned 0 [0042.984] GetLastError () returned 0xea [0042.984] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0042.984] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0042.986] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0042.987] SetEndOfFile (hFile=0xe8) returned 1 [0042.987] CloseHandle (hObject=0xe8) returned 1 [0042.987] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.987] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.987] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.987] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1ab4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.987] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x532ebf00, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x532ebf00, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x532ebf00, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0042.987] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1ab4f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1ab4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1d1650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.988] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0042.988] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0042.988] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.988] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0042.988] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.988] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="packages", cAlternateFileName="")) returned 0 [0042.988] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.988] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3638, dwReserved1=0x52436578, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0042.988] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0042.988] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x31373933, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0042.988] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.989] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.989] CryptHashData (hHash=0x5c8fc0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.989] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8f40) returned 1 [0042.989] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.989] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f8e0) returned 0 [0042.989] GetLastError () returned 0xea [0042.989] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.989] CreateFileA (lpFileName="C:\\Users\\All Users\\Start Menu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\start menu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.989] WriteFile (in: hFile=0xdc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.989] SetEndOfFile (hFile=0xdc) returned 1 [0042.989] CloseHandle (hObject=0xdc) returned 1 [0042.989] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0042.989] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.989] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x91\\")) returned 0xffffffff [0042.990] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="Sun", cAlternateFileName="")) returned 1 [0042.990] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.990] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.990] CryptHashData (hHash=0x5c8f40, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.990] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8fc0) returned 1 [0042.990] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0042.990] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f8e0) returned 0 [0042.990] GetLastError () returned 0xea [0042.990] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0042.991] CreateFileA (lpFileName="C:\\Users\\All Users\\Sun\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\sun\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0042.991] WriteFile (in: hFile=0xdc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0042.992] SetEndOfFile (hFile=0xdc) returned 1 [0042.992] CloseHandle (hObject=0xdc) returned 1 [0042.992] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0042.992] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.992] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xaa1d1650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1d1650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0042.993] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xaa1d1650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1d1650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.993] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1d1650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1d1650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1d1650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.993] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Java", cAlternateFileName="")) returned 1 [0042.993] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0042.993] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0042.993] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.993] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c9100) returned 1 [0042.993] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.993] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f678) returned 0 [0042.993] GetLastError () returned 0xea [0042.993] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f674*=0x260) returned 1 [0042.994] CreateFileA (lpFileName="C:\\Users\\All Users\\Sun\\Java\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\sun\\java\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0042.994] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0042.995] SetEndOfFile (hFile=0xf8) returned 1 [0042.995] CloseHandle (hObject=0xf8) returned 1 [0042.995] CryptDestroyKey (hKey=0x5c9100) returned 1 [0042.995] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.995] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xaa1d1650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1d1650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0042.996] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xaa1d1650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1d1650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.996] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1d1650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1d1650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1d1650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.996] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0042.996] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0042.996] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0042.996] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.996] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c91c0) returned 1 [0042.996] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0042.996] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f410) returned 0 [0042.996] GetLastError () returned 0xea [0042.996] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f40c*=0x260) returned 1 [0042.997] CreateFileA (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\sun\\java\\java update\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0042.997] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0042.998] SetEndOfFile (hFile=0xec) returned 1 [0042.998] CloseHandle (hObject=0xec) returned 1 [0042.998] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0042.998] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0042.998] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xaa1d1650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1d1650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0042.998] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xaa1d1650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1d1650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0042.998] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1d1650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1d1650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1d1650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0042.999] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="jaureglist.xml", cAlternateFileName="JAUREG~1.XML")) returned 1 [0042.999] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="jaureglist.xml", cAlternateFileName="JAUREG~1.XML")) returned 0 [0042.999] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0042.999] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0042.999] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0042.999] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Java", cAlternateFileName="")) returned 0 [0042.999] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0042.999] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52434e45, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0042.999] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0042.999] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0042.999] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0042.999] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c9100) returned 1 [0043.000] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.000] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18f8e0) returned 0 [0043.000] GetLastError () returned 0xea [0043.000] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.000] CreateFileA (lpFileName="C:\\Users\\All Users\\Templates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\all users\\templates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.000] WriteFile (in: hFile=0xdc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.000] SetEndOfFile (hFile=0xdc) returned 1 [0043.000] CloseHandle (hObject=0xdc) returned 1 [0043.000] CryptDestroyKey (hKey=0x5c9100) returned 1 [0043.000] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.000] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Templates\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="@\x91\\")) returned 0xffffffff [0043.001] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52434e45, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0043.001] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0043.001] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6a072b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a072b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20706568, dwReserved1=0x52434e45, cFileName="Default", cAlternateFileName="")) returned 1 [0043.001] CryptAcquireContextA (in: phProv=0x18fb3c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18fb3c*=0x5d0e80) returned 1 [0043.001] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18faf4 | out: phHash=0x18faf4) returned 1 [0043.001] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.001] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18fb38 | out: phKey=0x18fb38*=0x5c9100) returned 1 [0043.001] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.001] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18fb48*=0x258, dwBufLen=0x258 | out: pbData=0x33e2eac, pdwDataLen=0x18fb48) returned 0 [0043.001] GetLastError () returned 0xea [0043.001] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2eac*, pdwDataLen=0x18fb44*=0x258, dwBufLen=0x260 | out: pbData=0x33e2eac*, pdwDataLen=0x18fb44*=0x260) returned 1 [0043.002] CreateFileA (lpFileName="C:\\Users\\Default\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0043.002] WriteFile (in: hFile=0xf4, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f8c8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f8c8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.003] SetEndOfFile (hFile=0xf4) returned 1 [0043.003] CloseHandle (hObject=0xf4) returned 1 [0043.003] CryptDestroyKey (hKey=0x5c9100) returned 1 [0043.003] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.003] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa1d1650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1d1650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0043.003] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa1d1650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1d1650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.003] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AppData", cAlternateFileName="")) returned 1 [0043.004] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.004] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.004] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.004] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8f40) returned 1 [0043.004] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.004] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1950*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1950, pdwDataLen=0x18f8e0) returned 0 [0043.004] GetLastError () returned 0xea [0043.004] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1950*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1950*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.005] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.005] WriteFile (in: hFile=0xdc, lpBuffer=0x33e2a40*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33e2a40*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.006] SetEndOfFile (hFile=0xdc) returned 1 [0043.006] CloseHandle (hObject=0xdc) returned 1 [0043.006] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0043.006] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.006] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa1f77b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1f77b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0043.006] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa1f77b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1f77b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.006] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1f77b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1f77b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1f77b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.006] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Local", cAlternateFileName="")) returned 1 [0043.006] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.007] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.007] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.007] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c91c0) returned 1 [0043.007] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.007] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2a98*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2a98, pdwDataLen=0x18f678) returned 0 [0043.007] GetLastError () returned 0xea [0043.007] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2a98*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2a98*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.007] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.008] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.008] SetEndOfFile (hFile=0xf8) returned 1 [0043.009] CloseHandle (hObject=0xf8) returned 1 [0043.009] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.009] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.009] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa1f77b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1f77b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.009] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa1f77b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1f77b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.009] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x5a0000, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0043.009] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0043.009] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0043.009] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.009] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8fc0) returned 1 [0043.010] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.010] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18f410) returned 0 [0043.010] GetLastError () returned 0xea [0043.010] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f40c*=0x260) returned 1 [0043.010] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\application data\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0043.010] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0043.010] SetEndOfFile (hFile=0xec) returned 1 [0043.010] CloseHandle (hObject=0xec) returned 1 [0043.010] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.010] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.010] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f3a4, ftLastWriteTime.dwHighDateTime=0x18f3a0, nFileSizeHigh=0x18f3e8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x91\x5c")) returned 0xffffffff [0043.010] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e, cFileName="History", cAlternateFileName="")) returned 1 [0043.010] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0043.011] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0043.011] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.011] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c9140) returned 1 [0043.011] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.011] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2b00*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2b00, pdwDataLen=0x18f410) returned 0 [0043.011] GetLastError () returned 0xea [0043.011] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2b00*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2b00*, pdwDataLen=0x18f40c*=0x260) returned 1 [0043.011] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\history\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0043.020] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0043.021] SetEndOfFile (hFile=0xec) returned 1 [0043.021] CloseHandle (hObject=0xec) returned 1 [0043.021] CryptDestroyKey (hKey=0x5c9140) returned 1 [0043.021] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.021] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f3a4, ftLastWriteTime.dwHighDateTime=0x18f3a0, nFileSizeHigh=0x18f3e8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x91\x5c")) returned 0xffffffff [0043.022] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1f77b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1f77b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1f77b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.022] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x66b2700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xddd35f67, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xbd7f0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0043.022] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0043.022] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0043.022] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0043.022] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.022] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8fc0) returned 1 [0043.022] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.022] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2db0*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e2db0, pdwDataLen=0x18f410) returned 0 [0043.022] GetLastError () returned 0xea [0043.022] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2db0*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e2db0*, pdwDataLen=0x18f40c*=0x260) returned 1 [0043.023] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0043.023] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0043.024] SetEndOfFile (hFile=0xec) returned 1 [0043.024] CloseHandle (hObject=0xec) returned 1 [0043.024] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.024] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.024] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa21d910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa21d910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.024] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa21d910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa21d910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.024] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0043.024] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.025] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.025] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.025] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0043.025] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.025] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2a84*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2a84, pdwDataLen=0x18f1a8) returned 0 [0043.025] GetLastError () returned 0xea [0043.025] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2a84*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2a84*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.025] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\credentials\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.026] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.027] SetEndOfFile (hFile=0xe8) returned 1 [0043.027] CloseHandle (hObject=0xe8) returned 1 [0043.027] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.027] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.027] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa21d910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa21d910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.027] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa21d910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa21d910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.027] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa21d910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa21d910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa21d910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.027] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa21d910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa21d910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa21d910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.027] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.027] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Feeds", cAlternateFileName="")) returned 1 [0043.027] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.028] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.028] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.028] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9140) returned 1 [0043.028] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.028] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2d78*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e2d78, pdwDataLen=0x18f1a8) returned 0 [0043.028] GetLastError () returned 0xea [0043.028] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2d78*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e2d78*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.029] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.031] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.032] SetEndOfFile (hFile=0xe8) returned 1 [0043.032] CloseHandle (hObject=0xe8) returned 1 [0043.032] CryptDestroyKey (hKey=0x5c9140) returned 1 [0043.032] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.032] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa21d910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa21d910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0043.032] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa21d910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa21d910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.032] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff107f92, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0043.032] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa21d910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa21d910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa21d910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.033] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1 [0043.033] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.033] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.033] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.033] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c90c0) returned 1 [0043.033] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.033] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e19ac*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e19ac, pdwDataLen=0x18ef40) returned 0 [0043.033] GetLastError () returned 0xea [0043.033] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e19ac*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e19ac*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.034] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.035] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.036] SetEndOfFile (hFile=0xf0) returned 1 [0043.036] CloseHandle (hObject=0xf0) returned 1 [0043.036] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.036] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.036] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.036] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.036] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa243a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.036] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1 [0043.036] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1 [0043.036] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1 [0043.036] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0 [0043.036] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.036] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1 [0043.036] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.037] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.037] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.037] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0043.037] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.037] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.037] GetLastError () returned 0xea [0043.037] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.037] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.038] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.039] SetEndOfFile (hFile=0xf0) returned 1 [0043.039] CloseHandle (hObject=0xf0) returned 1 [0043.039] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.039] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.039] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.039] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.039] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa243a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.039] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1 [0043.039] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.040] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.040] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.040] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8f80) returned 1 [0043.040] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.040] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ecd8) returned 0 [0043.040] GetLastError () returned 0xea [0043.040] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.040] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.041] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.041] SetEndOfFile (hFile=0x108) returned 1 [0043.041] CloseHandle (hObject=0x108) returned 1 [0043.042] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0043.042] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.042] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0043.042] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.042] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa243a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.042] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 1 [0043.042] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0 [0043.042] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0043.042] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 0 [0043.042] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.042] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0 [0043.042] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0043.042] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa65446b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65446b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0043.042] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.043] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.043] CryptHashData (hHash=0x5c9140, pbData=0x33e193c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.043] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0043.043] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.043] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18f1a8) returned 0 [0043.043] GetLastError () returned 0xea [0043.043] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.043] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.043] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.044] SetEndOfFile (hFile=0xe8) returned 1 [0043.044] CloseHandle (hObject=0xe8) returned 1 [0043.044] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.045] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.045] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.045] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.045] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa651e550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa651e550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1 [0043.045] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.045] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.045] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.045] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0043.045] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.045] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.045] GetLastError () returned 0xea [0043.045] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.046] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.048] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.048] SetEndOfFile (hFile=0xf0) returned 1 [0043.049] CloseHandle (hObject=0xf0) returned 1 [0043.049] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0043.049] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.049] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0043.049] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.049] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa651e550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa651e550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa651e550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.049] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0043.049] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa243a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.049] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa243a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.049] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0043.049] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa651e550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa651e550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1 [0043.049] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.050] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.050] CryptHashData (hHash=0x5c8f80, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.050] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9140) returned 1 [0043.050] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0043.050] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.050] GetLastError () returned 0xea [0043.050] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.050] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.052] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.053] SetEndOfFile (hFile=0xf0) returned 1 [0043.053] CloseHandle (hObject=0xf0) returned 1 [0043.053] CryptDestroyKey (hKey=0x5c9140) returned 1 [0043.053] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.053] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa269bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0043.053] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa269bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.053] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa651e550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa651e550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa651e550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.053] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0043.053] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa269bd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa269bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.053] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa269bd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa269bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.053] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0043.053] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa651e550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa651e550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1 [0043.053] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.054] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.054] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.054] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0043.054] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.054] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.054] GetLastError () returned 0xea [0043.054] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.054] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.056] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.057] SetEndOfFile (hFile=0xf0) returned 1 [0043.057] CloseHandle (hObject=0xf0) returned 1 [0043.057] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0043.057] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.057] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa269bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0043.057] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa269bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.057] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa651e550, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa651e550, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa651e550, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.057] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0043.057] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa269bd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa269bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.057] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa269bd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa269bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.057] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0043.058] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa65446b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa65446b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65446b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.058] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa243a70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa243a70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa243a70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.058] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x668c5a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x668c5a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa9d0d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="index.dat", cAlternateFileName="")) returned 1 [0043.058] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa65446b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65446b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1 [0043.058] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.058] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.058] CryptHashData (hHash=0x5c8f80, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.058] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9140) returned 1 [0043.058] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0043.058] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.058] GetLastError () returned 0xea [0043.058] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.059] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.060] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.061] SetEndOfFile (hFile=0xf0) returned 1 [0043.061] CloseHandle (hObject=0xf0) returned 1 [0043.061] CryptDestroyKey (hKey=0x5c9140) returned 1 [0043.061] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.061] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa269bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0043.061] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa269bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.062] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa65446b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa65446b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65446b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.062] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0043.062] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa269bd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa269bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.062] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa269bd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa269bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.062] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0043.062] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa65446b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65446b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0 [0043.062] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.062] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa21d910, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa21d910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa21d910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.062] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa656a810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa656a810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0043.062] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.062] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.062] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.063] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9140) returned 1 [0043.063] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.063] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18f1a8) returned 0 [0043.063] GetLastError () returned 0xea [0043.063] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.063] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.065] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.066] SetEndOfFile (hFile=0xe8) returned 1 [0043.066] CloseHandle (hObject=0xe8) returned 1 [0043.066] CryptDestroyKey (hKey=0x5c9140) returned 1 [0043.066] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.066] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0043.066] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.066] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff12e0f2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="brndlog.bak", cAlternateFileName="")) returned 1 [0043.066] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa65446b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa65446b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa656a810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="brndlog.txt.crypt", cAlternateFileName="BRNDLO~1.CRY")) returned 1 [0043.066] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa269bd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.066] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa269bd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa269bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.066] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0043.066] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0043.066] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.067] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.067] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.067] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0043.067] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.067] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18f1a8) returned 0 [0043.067] GetLastError () returned 0xea [0043.067] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.067] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.068] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.068] SetEndOfFile (hFile=0xe8) returned 1 [0043.069] CloseHandle (hObject=0xe8) returned 1 [0043.069] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.069] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.069] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.069] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.069] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8679d27, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1 [0043.069] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa28fd30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.069] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1 [0043.069] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1 [0043.069] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.070] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.070] CryptHashData (hHash=0x5c9140, pbData=0x33e2b58, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.070] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0043.070] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.070] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.070] GetLastError () returned 0xea [0043.070] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.070] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.070] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.071] SetEndOfFile (hFile=0xf0) returned 1 [0043.071] CloseHandle (hObject=0xf0) returned 1 [0043.071] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0043.072] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.072] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0043.072] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.072] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0043.072] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.072] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.072] CryptHashData (hHash=0x5c9140, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.072] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c90c0) returned 1 [0043.072] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.072] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ecd8) returned 0 [0043.073] GetLastError () returned 0xea [0043.073] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.073] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.073] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.074] SetEndOfFile (hFile=0x108) returned 1 [0043.074] CloseHandle (hObject=0x108) returned 1 [0043.074] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.074] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.074] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.074] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.074] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="00010C6E", cAlternateFileName="")) returned 1 [0043.074] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0043.075] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0043.075] CryptHashData (hHash=0x5c9140, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.075] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9200) returned 1 [0043.075] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.075] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ea70) returned 0 [0043.075] GetLastError () returned 0xea [0043.075] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0043.075] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.076] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.077] SetEndOfFile (hFile=0x114) returned 1 [0043.077] CloseHandle (hObject=0x114) returned 1 [0043.077] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.078] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.078] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6666440, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6666440, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa28fd30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa28fd30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.078] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa28fd30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa28fd30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.078] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa28fd30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa28fd30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.078] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0043.078] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 0 [0043.079] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.079] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66d8860, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62737473, dwReserved1=0x52434e45, cFileName="Windows", cAlternateFileName="")) returned 1 [0043.079] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.079] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.079] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.079] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f80) returned 1 [0043.079] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.079] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18f1a8) returned 0 [0043.079] GetLastError () returned 0xea [0043.079] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.080] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.080] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.081] SetEndOfFile (hFile=0xe8) returned 1 [0043.081] CloseHandle (hObject=0xe8) returned 1 [0043.081] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0043.081] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.081] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0043.081] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.081] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Burn", cAlternateFileName="")) returned 1 [0043.081] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.082] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.082] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.082] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c90c0) returned 1 [0043.082] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.082] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.082] GetLastError () returned 0xea [0043.082] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.083] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.083] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.084] SetEndOfFile (hFile=0xf0) returned 1 [0043.084] CloseHandle (hObject=0xf0) returned 1 [0043.084] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.084] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.084] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.084] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.084] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa656a810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa656a810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Burn", cAlternateFileName="")) returned 1 [0043.084] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.085] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.085] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.085] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9200) returned 1 [0043.085] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.085] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ecd8) returned 0 [0043.085] GetLastError () returned 0xea [0043.085] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.085] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.086] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.087] SetEndOfFile (hFile=0x108) returned 1 [0043.087] CloseHandle (hObject=0x108) returned 1 [0043.087] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.087] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.087] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.087] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.087] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa656a810, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa656a810, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa656a810, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.087] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa2b5e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.087] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa2b5e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.087] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.087] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa2b5e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.087] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa2b5e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.087] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.087] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Caches", cAlternateFileName="")) returned 1 [0043.087] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.088] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.088] CryptHashData (hHash=0x5c90c0, pbData=0x33e193c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.088] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9200) returned 1 [0043.088] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.088] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.088] GetLastError () returned 0xea [0043.088] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.088] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\caches\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.089] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.090] SetEndOfFile (hFile=0xf0) returned 1 [0043.090] CloseHandle (hObject=0xf0) returned 1 [0043.090] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.090] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.090] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.090] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.090] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa2b5e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.090] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa2b5e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.090] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.090] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Explorer", cAlternateFileName="")) returned 1 [0043.090] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.091] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.091] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.091] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c90c0) returned 1 [0043.091] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.091] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.091] GetLastError () returned 0xea [0043.091] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.091] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.092] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.093] SetEndOfFile (hFile=0xf0) returned 1 [0043.093] CloseHandle (hObject=0xf0) returned 1 [0043.093] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.093] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.093] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.094] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.094] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66402e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66402e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4777f11, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1 [0043.094] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xeb8291b2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1 [0043.094] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa2b5e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.094] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1 [0043.094] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_256.db", cAlternateFileName="TH5A2B~1.DB")) returned 1 [0043.094] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~4.DB")) returned 1 [0043.094] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1 [0043.094] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~2.DB")) returned 1 [0043.094] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 1 [0043.094] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 0 [0043.094] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.094] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x52626262, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0043.094] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.095] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.095] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.095] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9200) returned 1 [0043.095] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.095] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.095] GetLastError () returned 0xea [0043.095] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.095] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\gameexplorer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.095] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.096] SetEndOfFile (hFile=0xf0) returned 1 [0043.096] CloseHandle (hObject=0xf0) returned 1 [0043.097] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.097] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.097] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.097] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2b5e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.097] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa2b5e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.097] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa2b5e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2b5e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.097] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.097] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa21d910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa21d910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="History", cAlternateFileName="")) returned 1 [0043.097] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.098] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.098] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.098] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c90c0) returned 1 [0043.098] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.098] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.098] GetLastError () returned 0xea [0043.098] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.098] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.098] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.098] SetEndOfFile (hFile=0xf0) returned 1 [0043.098] CloseHandle (hObject=0xf0) returned 1 [0043.098] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.098] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.098] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa21d910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa21d910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.099] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa21d910, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa21d910, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.099] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6590970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6590970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6590970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.099] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6590970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6590970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0043.099] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.099] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.099] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.099] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0043.099] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.099] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ecd8) returned 0 [0043.099] GetLastError () returned 0xea [0043.099] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.100] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.100] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.101] SetEndOfFile (hFile=0x108) returned 1 [0043.101] CloseHandle (hObject=0x108) returned 1 [0043.101] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.101] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.101] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.101] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.101] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6590970, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6590970, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6590970, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.101] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa2dbff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.101] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0043.101] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x661a180, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x661a180, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 0 [0043.101] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.101] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1f77b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1f77b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.102] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Low", cAlternateFileName="")) returned 1 [0043.102] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.102] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.102] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.102] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9200) returned 1 [0043.102] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.102] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ecd8) returned 0 [0043.102] GetLastError () returned 0xea [0043.102] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.103] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\low\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.103] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.104] SetEndOfFile (hFile=0x108) returned 1 [0043.104] CloseHandle (hObject=0x108) returned 1 [0043.104] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.104] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.104] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.104] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.104] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa2dbff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.104] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa2dbff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.104] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.105] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Low", cAlternateFileName="")) returned 0 [0043.105] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.105] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa28fd30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa28fd30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa28fd30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.105] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0043.105] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.105] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.105] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.105] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9200) returned 1 [0043.105] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.105] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.105] GetLastError () returned 0xea [0043.105] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.106] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\ringtones\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.106] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.107] SetEndOfFile (hFile=0xf0) returned 1 [0043.107] CloseHandle (hObject=0xf0) returned 1 [0043.107] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.107] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.107] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.108] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.108] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa2dbff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.108] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa2dbff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.108] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.108] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa65dcc30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65dcc30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0043.108] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.108] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.108] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.108] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c90c0) returned 1 [0043.108] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.108] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.108] GetLastError () returned 0xea [0043.108] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.109] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.109] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.110] SetEndOfFile (hFile=0xf0) returned 1 [0043.111] CloseHandle (hObject=0xf0) returned 1 [0043.111] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.111] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.111] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.111] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.111] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa65b6ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65b6ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0043.111] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.112] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.112] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.112] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0043.112] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.112] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ecd8) returned 0 [0043.112] GetLastError () returned 0xea [0043.112] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.112] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.112] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.113] SetEndOfFile (hFile=0x108) returned 1 [0043.113] CloseHandle (hObject=0x108) returned 1 [0043.113] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.113] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.114] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.114] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.114] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa65b6ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa65b6ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65b6ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.114] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa302150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.114] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e3cd240, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0043.114] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa65b6ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65b6ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1 [0043.114] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0043.114] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0043.114] CryptHashData (hHash=0x5c9200, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.114] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9140) returned 1 [0043.114] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.114] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ea70) returned 0 [0043.115] GetLastError () returned 0xea [0043.115] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0043.115] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.115] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.116] SetEndOfFile (hFile=0x114) returned 1 [0043.116] CloseHandle (hObject=0x114) returned 1 [0043.116] CryptDestroyKey (hKey=0x5c9140) returned 1 [0043.116] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.116] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0043.116] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.116] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa65b6ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa65b6ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65b6ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.116] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa302150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.117] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa302150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.117] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0043.117] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa65b6ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65b6ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1 [0043.117] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0043.117] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0043.117] CryptHashData (hHash=0x5c9140, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.117] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9200) returned 1 [0043.117] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.117] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ea70) returned 0 [0043.117] GetLastError () returned 0xea [0043.117] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0043.118] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.118] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.119] SetEndOfFile (hFile=0x114) returned 1 [0043.119] CloseHandle (hObject=0x114) returned 1 [0043.119] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.119] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.119] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.119] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.119] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa65b6ad0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa65b6ad0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65b6ad0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.119] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa302150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.119] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa302150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.119] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.119] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa65dcc30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65dcc30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1 [0043.119] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0043.120] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0043.120] CryptHashData (hHash=0x5c9200, pbData=0x33e193c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.120] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9140) returned 1 [0043.120] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.120] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ea70) returned 0 [0043.120] GetLastError () returned 0xea [0043.120] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0043.120] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.121] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.122] SetEndOfFile (hFile=0x114) returned 1 [0043.122] CloseHandle (hObject=0x114) returned 1 [0043.122] CryptDestroyKey (hKey=0x5c9140) returned 1 [0043.122] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.122] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0043.122] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.122] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa65dcc30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa65dcc30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65dcc30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.122] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa302150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.122] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa302150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.122] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0043.122] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa65dcc30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65dcc30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="X9OHK109", cAlternateFileName="")) returned 1 [0043.122] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0043.123] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0043.123] CryptHashData (hHash=0x5c9140, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.123] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9200) returned 1 [0043.123] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.123] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ea70) returned 0 [0043.123] GetLastError () returned 0xea [0043.123] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0043.123] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.124] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.124] SetEndOfFile (hFile=0x114) returned 1 [0043.125] CloseHandle (hObject=0x114) returned 1 [0043.125] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.125] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.125] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.125] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.125] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa65dcc30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa65dcc30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65dcc30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.125] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa302150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.125] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa302150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.125] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.125] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa65dcc30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65dcc30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="X9OHK109", cAlternateFileName="")) returned 0 [0043.125] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.125] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa65dcc30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa65dcc30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa65dcc30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.125] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa2dbff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa2dbff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa2dbff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.125] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Low", cAlternateFileName="")) returned 1 [0043.125] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.126] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.126] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.126] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9200) returned 1 [0043.126] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.126] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ecd8) returned 0 [0043.126] GetLastError () returned 0xea [0043.126] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.126] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.127] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.128] SetEndOfFile (hFile=0x108) returned 1 [0043.128] CloseHandle (hObject=0x108) returned 1 [0043.128] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.128] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.128] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.128] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa302150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.128] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa302150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.128] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa302150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa302150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.128] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.128] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0043.128] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.129] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.129] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.129] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0043.129] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.129] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ecd8) returned 0 [0043.129] GetLastError () returned 0xea [0043.129] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.129] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\virtualized\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.130] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.131] SetEndOfFile (hFile=0x108) returned 1 [0043.131] CloseHandle (hObject=0x108) returned 1 [0043.131] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.131] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.131] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.131] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.131] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa3282b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.131] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa3282b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.131] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.131] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0043.131] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.131] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x579672e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0043.131] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65f4020, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65f4020, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x579672e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1 [0043.131] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65cdec0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65cdec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1 [0043.132] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x65cdec0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x65cdec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1 [0043.132] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6581c00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6581c00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1 [0043.132] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1 [0043.132] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="WER", cAlternateFileName="")) returned 1 [0043.132] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.132] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.132] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.132] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0043.132] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.132] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.132] GetLastError () returned 0xea [0043.132] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.133] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\wer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.133] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.134] SetEndOfFile (hFile=0xf0) returned 1 [0043.134] CloseHandle (hObject=0xf0) returned 1 [0043.134] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.134] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.134] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.134] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.135] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ERC", cAlternateFileName="")) returned 1 [0043.135] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.135] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.135] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.135] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9200) returned 1 [0043.135] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.135] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ecd8) returned 0 [0043.135] GetLastError () returned 0xea [0043.135] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.136] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\wer\\erc\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.136] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.137] SetEndOfFile (hFile=0x108) returned 1 [0043.137] CloseHandle (hObject=0x108) returned 1 [0043.137] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.137] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.137] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.137] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.137] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa3282b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.137] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa3282b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.137] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.137] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa3282b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.137] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0043.137] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.138] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.138] CryptHashData (hHash=0x5c9200, pbData=0x33e2fa8, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.138] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c90c0) returned 1 [0043.138] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.138] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ecd8) returned 0 [0043.138] GetLastError () returned 0xea [0043.138] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.138] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\wer\\reportarchive\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.139] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.140] SetEndOfFile (hFile=0x108) returned 1 [0043.140] CloseHandle (hObject=0x108) returned 1 [0043.140] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.140] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.140] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.140] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.140] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xaa3282b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.140] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xaa3282b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.140] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.140] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0 [0043.140] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.140] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="WER", cAlternateFileName="")) returned 0 [0043.140] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0043.140] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66307b74, dwReserved1=0x61376436, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1 [0043.141] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.141] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.141] CryptHashData (hHash=0x5c8f80, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.141] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0043.141] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0043.141] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18f1a8) returned 0 [0043.141] GetLastError () returned 0xea [0043.141] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.142] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.142] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.143] SetEndOfFile (hFile=0xe8) returned 1 [0043.143] CloseHandle (hObject=0xe8) returned 1 [0043.143] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.143] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.143] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.143] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3282b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.143] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1 [0043.143] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1 [0043.143] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6535940, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6535940, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1 [0043.143] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Backup", cAlternateFileName="")) returned 1 [0043.143] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.144] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.144] CryptHashData (hHash=0x5c8f80, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.144] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c90c0) returned 1 [0043.144] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0043.144] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.144] GetLastError () returned 0xea [0043.144] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.144] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.145] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.146] SetEndOfFile (hFile=0xf0) returned 1 [0043.146] CloseHandle (hObject=0xf0) returned 1 [0043.146] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.146] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.146] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.146] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.146] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa34e410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.146] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="new", cAlternateFileName="")) returned 1 [0043.146] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.147] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.147] CryptHashData (hHash=0x5c8f80, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.147] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c9200) returned 1 [0043.147] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0043.147] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ecd8) returned 0 [0043.147] GetLastError () returned 0xea [0043.147] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.147] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.148] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.149] SetEndOfFile (hFile=0x108) returned 1 [0043.149] CloseHandle (hObject=0x108) returned 1 [0043.149] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.149] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.149] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.149] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.149] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x650f7e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0043.149] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa34e410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.149] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e9680, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64e9680, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0043.149] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e9680, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64e9680, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0043.149] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e9680, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64e9680, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0043.149] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.149] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="new", cAlternateFileName="")) returned 0 [0043.149] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.150] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd7bc3a13, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0043.150] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd7bc3a13, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="edb.log", cAlternateFileName="")) returned 1 [0043.150] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0043.150] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0043.150] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0043.150] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa3282b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa3282b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.150] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="oeold.xml", cAlternateFileName="")) returned 1 [0043.150] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa669b310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa669b310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0043.150] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.150] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.150] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.150] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9200) returned 1 [0043.150] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.150] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.150] GetLastError () returned 0xea [0043.151] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.151] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.151] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.152] SetEndOfFile (hFile=0xf0) returned 1 [0043.152] CloseHandle (hObject=0xf0) returned 1 [0043.152] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.152] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.152] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.152] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6602d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6602d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6602d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Bears.jpg.crypt", cAlternateFileName="BEARSJ~1.CRY")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6602d90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6602d90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6602d90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x650f7e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6628ef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6628ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6628ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Garden.jpg.crypt", cAlternateFileName="GARDEN~1.CRY")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6628ef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6628ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6628ef0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="GreenBubbles.jpg.crypt", cAlternateFileName="GREENB~1.CRY")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6628ef0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6628ef0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa664f050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HandPrints.jpg.crypt", cAlternateFileName="HANDPR~1.CRY")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa34e410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa664f050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa664f050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa664f050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="OrangeCircles.jpg.crypt", cAlternateFileName="ORANGE~1.CRY")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa664f050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa664f050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa664f050, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Peacock.jpg.crypt", cAlternateFileName="PEACOC~1.CRY")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa664f050, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa664f050, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa66751b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Roses.jpg.crypt", cAlternateFileName="ROSESJ~1.CRY")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64c3520, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x64c3520, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa66751b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa66751b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa66751b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ShadesOfBlue.jpg.crypt", cAlternateFileName="SHADES~1.CRY")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6477260, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6477260, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa66751b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa66751b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa669b310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="SoftBlue.jpg.crypt", cAlternateFileName="SOFTBL~1.CRY")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x649d3c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x649d3c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa669b310, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa669b310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa669b310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Stars.jpg.crypt", cAlternateFileName="STARSJ~1.CRY")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa669b310, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa669b310, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa669b310, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Stars.jpg.crypt", cAlternateFileName="STARSJ~1.CRY")) returned 0 [0043.153] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd7b05332, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x74707972, dwReserved1=0x72747079, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x74707972, dwReserved1=0x72747079, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x74707972, dwReserved1=0x72747079, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0043.153] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.154] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0043.154] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.154] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.154] CryptHashData (hHash=0x5c8ec0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.154] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9200) returned 1 [0043.154] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.154] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18f1a8) returned 0 [0043.154] GetLastError () returned 0xea [0043.154] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.155] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.155] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.156] SetEndOfFile (hFile=0xe8) returned 1 [0043.156] CloseHandle (hObject=0xe8) returned 1 [0043.156] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.156] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.156] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.156] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.156] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="12.0", cAlternateFileName="")) returned 1 [0043.156] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.157] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.157] CryptHashData (hHash=0x5c8ec0, pbData=0x33e2a84, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.157] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c90c0) returned 1 [0043.157] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.157] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.157] GetLastError () returned 0xea [0043.157] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.157] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.158] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.159] SetEndOfFile (hFile=0xf0) returned 1 [0043.159] CloseHandle (hObject=0xf0) returned 1 [0043.159] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.159] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.159] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.159] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.159] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa34e410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa374570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.159] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1 [0043.159] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1 [0043.160] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0 [0043.160] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.160] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa34e410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.160] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa34e410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa34e410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa34e410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.160] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.160] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa66c1470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa66c1470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0043.160] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.160] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.160] CryptHashData (hHash=0x5c9200, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.160] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c90c0) returned 1 [0043.160] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.161] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18f1a8) returned 0 [0043.161] GetLastError () returned 0xea [0043.161] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.161] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.163] WriteFile (in: hFile=0xe8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.163] SetEndOfFile (hFile=0xe8) returned 1 [0043.164] CloseHandle (hObject=0xe8) returned 1 [0043.164] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.164] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.164] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa374570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa374570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.164] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa374570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa374570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.164] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0043.164] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.164] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.164] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.164] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0043.164] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.164] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18ef40) returned 0 [0043.165] GetLastError () returned 0xea [0043.165] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.165] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\gadgets\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.165] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.166] SetEndOfFile (hFile=0xf0) returned 1 [0043.166] CloseHandle (hObject=0xf0) returned 1 [0043.166] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.166] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.166] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa374570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa374570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.166] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa374570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa374570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.167] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa374570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa374570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa374570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.167] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa374570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa374570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa374570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.167] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.167] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa374570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa374570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa374570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.167] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa66c1470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa66c1470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa66c1470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Settings.ini.crypt", cAlternateFileName="SETTIN~1.CRY")) returned 1 [0043.167] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa66c1470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa66c1470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa66c1470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Settings.ini.crypt", cAlternateFileName="SETTIN~1.CRY")) returned 0 [0043.167] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.167] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa66c1470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa66c1470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0043.167] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.167] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa66c1470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa66c1470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x52437265, cFileName="Temp", cAlternateFileName="")) returned 1 [0043.167] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0043.168] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0043.168] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.168] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0043.168] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.168] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18f410) returned 0 [0043.168] GetLastError () returned 0xea [0043.168] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18f40c*=0x260) returned 1 [0043.168] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\temp\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0043.168] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0043.169] SetEndOfFile (hFile=0xec) returned 1 [0043.169] CloseHandle (hObject=0xec) returned 1 [0043.170] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.170] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.170] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa374570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa374570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.170] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa374570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa374570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.170] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa66c1470, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa66c1470, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa66c1470, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="FXSAPIDebugLogFile.txt.crypt", cAlternateFileName="FXSAPI~1.CRY")) returned 1 [0043.170] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa374570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa374570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa374570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.170] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa374570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa374570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa374570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.170] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.170] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52434e45, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0043.170] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0043.171] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0043.171] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.171] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8fc0) returned 1 [0043.171] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.171] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f410) returned 0 [0043.171] GetLastError () returned 0xea [0043.171] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f40c*=0x260) returned 1 [0043.171] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\local\\temporary internet files\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0043.171] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0043.171] SetEndOfFile (hFile=0xec) returned 1 [0043.174] CloseHandle (hObject=0xec) returned 1 [0043.175] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.175] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.175] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f3a4, ftLastWriteTime.dwHighDateTime=0x18f3a0, nFileSizeHigh=0x18f3e8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x91\x5c")) returned 0xffffffff [0043.175] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52434e45, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0043.175] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.175] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0043.175] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.175] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.175] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.176] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8fc0) returned 1 [0043.176] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.176] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f678) returned 0 [0043.176] GetLastError () returned 0xea [0043.176] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.176] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\locallow\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.176] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.177] SetEndOfFile (hFile=0xf8) returned 1 [0043.177] CloseHandle (hObject=0xf8) returned 1 [0043.177] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.177] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.178] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa39a6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa39a6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.178] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa39a6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa39a6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.178] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa39a6d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa39a6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa39a6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.178] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0043.178] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0043.178] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0043.178] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.178] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c90c0) returned 1 [0043.178] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.178] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f410) returned 0 [0043.179] GetLastError () returned 0xea [0043.179] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f40c*=0x260) returned 1 [0043.179] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0043.179] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0043.180] SetEndOfFile (hFile=0xec) returned 1 [0043.180] CloseHandle (hObject=0xec) returned 1 [0043.180] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.180] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.180] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa39a6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa39a6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.180] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa39a6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa39a6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.181] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0043.181] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.181] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.181] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.181] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0043.181] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.181] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f1a8) returned 0 [0043.181] GetLastError () returned 0xea [0043.181] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.182] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.182] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.183] SetEndOfFile (hFile=0xe8) returned 1 [0043.183] CloseHandle (hObject=0xe8) returned 1 [0043.183] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.183] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.183] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa39a6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa39a6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.183] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa39a6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa39a6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.183] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Content", cAlternateFileName="")) returned 1 [0043.183] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.184] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.184] CryptHashData (hHash=0x5c91c0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.184] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9200) returned 1 [0043.184] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.184] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.184] GetLastError () returned 0xea [0043.184] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.184] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.198] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.199] SetEndOfFile (hFile=0xf0) returned 1 [0043.199] CloseHandle (hObject=0xf0) returned 1 [0043.199] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.199] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.199] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa3c0830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3c0830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.199] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa3c0830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3c0830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.199] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0043.199] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0043.199] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa39a6d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa39a6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3c0830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.199] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa39a6d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa39a6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa3c0830, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.199] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.199] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa39a6d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa39a6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa39a6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.199] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MetaData", cAlternateFileName="")) returned 1 [0043.199] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.200] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.200] CryptHashData (hHash=0x5c9200, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.200] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c91c0) returned 1 [0043.200] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.200] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.200] GetLastError () returned 0xea [0043.200] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.200] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.373] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.374] SetEndOfFile (hFile=0xf0) returned 1 [0043.374] CloseHandle (hObject=0xf0) returned 1 [0043.374] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.374] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.374] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa563750, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa563750, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.374] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa563750, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa563750, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.375] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x6451100, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0043.375] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0043.375] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa3c0830, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa3c0830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa563750, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.375] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa3c0830, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa3c0830, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa563750, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.375] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.375] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="MetaData", cAlternateFileName="")) returned 0 [0043.375] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.375] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa39a6d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa39a6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa39a6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.375] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa39a6d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa39a6d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa39a6d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.375] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.375] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0043.375] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.375] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Roaming", cAlternateFileName="")) returned 1 [0043.375] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.376] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.376] CryptHashData (hHash=0x5c8fc0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.376] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0043.376] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.376] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f678) returned 0 [0043.376] GetLastError () returned 0xea [0043.376] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.376] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.377] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.378] SetEndOfFile (hFile=0xf8) returned 1 [0043.378] CloseHandle (hObject=0xf8) returned 1 [0043.378] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.378] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.378] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa563750, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa563750, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.378] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa563750, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa563750, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.378] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa563750, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa563750, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.378] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0043.378] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0043.379] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0043.379] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.379] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c8ec0) returned 1 [0043.379] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.379] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f410) returned 0 [0043.379] GetLastError () returned 0xea [0043.379] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f40c*=0x260) returned 1 [0043.379] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\identities\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0043.380] WriteFile (in: hFile=0xec, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0043.380] SetEndOfFile (hFile=0xec) returned 1 [0043.380] CloseHandle (hObject=0xec) returned 1 [0043.381] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.381] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.381] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.381] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.381] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5898b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.381] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0043.381] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.381] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.381] CryptHashData (hHash=0x5c8fc0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.382] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c91c0) returned 1 [0043.382] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.382] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f1a8) returned 0 [0043.382] GetLastError () returned 0xea [0043.382] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.382] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.382] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.383] SetEndOfFile (hFile=0xe8) returned 1 [0043.383] CloseHandle (hObject=0xe8) returned 1 [0043.383] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.383] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.383] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.384] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.384] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5898b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.384] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5898b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.384] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.384] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0043.384] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.384] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0043.384] CryptAcquireContextA (in: phProv=0x18f404, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f404*=0x5d0e80) returned 1 [0043.384] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f3bc | out: phHash=0x18f3bc) returned 1 [0043.384] CryptHashData (hHash=0x5c8ec0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.384] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f400 | out: phKey=0x18f400*=0x5c91c0) returned 1 [0043.385] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.385] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f410*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f410) returned 0 [0043.385] GetLastError () returned 0xea [0043.385] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f40c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f40c*=0x260) returned 1 [0043.385] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0043.385] WriteFile (in: hFile=0xec, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f190, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f190*=0x7a0, lpOverlapped=0x0) returned 1 [0043.386] SetEndOfFile (hFile=0xec) returned 1 [0043.386] CloseHandle (hObject=0xec) returned 1 [0043.386] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.386] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.386] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.386] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.387] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0043.387] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.387] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.387] CryptHashData (hHash=0x5c8ec0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.387] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8fc0) returned 1 [0043.387] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.387] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f1a8) returned 0 [0043.387] GetLastError () returned 0xea [0043.387] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.388] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\credentials\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.388] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.389] SetEndOfFile (hFile=0xe8) returned 1 [0043.389] CloseHandle (hObject=0xe8) returned 1 [0043.389] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.389] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.389] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.389] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.389] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5898b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.389] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5898b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.389] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.390] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Crypto", cAlternateFileName="")) returned 1 [0043.390] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.390] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.390] CryptHashData (hHash=0x5c8fc0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.390] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8ec0) returned 1 [0043.390] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.390] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f1a8) returned 0 [0043.390] GetLastError () returned 0xea [0043.390] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.391] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\crypto\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.391] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.392] SetEndOfFile (hFile=0xe8) returned 1 [0043.392] CloseHandle (hObject=0xe8) returned 1 [0043.393] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.393] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.393] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.394] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.394] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5898b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.394] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RSA", cAlternateFileName="")) returned 1 [0043.396] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.397] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.397] CryptHashData (hHash=0x5c8fc0, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.397] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9200) returned 1 [0043.397] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.397] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.397] GetLastError () returned 0xea [0043.397] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.397] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\crypto\\rsa\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.398] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.398] SetEndOfFile (hFile=0xf0) returned 1 [0043.399] CloseHandle (hObject=0xf0) returned 1 [0043.399] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.399] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.399] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5afa10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5afa10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.399] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5afa10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5afa10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.399] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5afa10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5afa10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5afa10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.399] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5afa10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5afa10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5afa10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.399] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.399] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RSA", cAlternateFileName="")) returned 0 [0043.399] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.399] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5898b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5898b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5898b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.399] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0043.399] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.400] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.400] CryptHashData (hHash=0x5c8ec0, pbData=0x33e2e20, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.400] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9200) returned 1 [0043.400] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.400] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f1a8) returned 0 [0043.400] GetLastError () returned 0xea [0043.400] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.400] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.401] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.401] SetEndOfFile (hFile=0xe8) returned 1 [0043.402] CloseHandle (hObject=0xe8) returned 1 [0043.402] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.402] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.402] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa5afa10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5afa10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.402] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa5afa10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5afa10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.402] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5afa10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5afa10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5afa10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.402] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6733890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6733890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0043.402] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.402] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.402] CryptHashData (hHash=0x5c8ec0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.402] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0043.403] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.403] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.403] GetLastError () returned 0xea [0043.403] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.403] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.403] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.404] SetEndOfFile (hFile=0xf0) returned 1 [0043.404] CloseHandle (hObject=0xf0) returned 1 [0043.404] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.404] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.404] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa5afa10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5afa10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.404] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa5afa10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5afa10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.404] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa66e75d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa66e75d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa66e75d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.405] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5afa10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5afa10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5afa10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.405] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa66e75d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa66e75d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa66e75d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Shows Desktop.lnk.crypt", cAlternateFileName="SHOWSD~1.CRY")) returned 1 [0043.405] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1 [0043.405] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.405] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.405] CryptHashData (hHash=0x5c8ec0, pbData=0x211c04, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.405] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8f80) returned 1 [0043.405] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.405] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ecd8) returned 0 [0043.405] GetLastError () returned 0xea [0043.405] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.406] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.410] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.411] SetEndOfFile (hFile=0x108) returned 1 [0043.411] CloseHandle (hObject=0x108) returned 1 [0043.411] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0043.411] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.411] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0043.411] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.411] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5afa10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5afa10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.411] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0043.411] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0043.412] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0043.412] CryptHashData (hHash=0x5c8ec0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.412] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9140) returned 1 [0043.412] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.412] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ea70) returned 0 [0043.412] GetLastError () returned 0xea [0043.412] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0043.412] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.413] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.413] SetEndOfFile (hFile=0x114) returned 1 [0043.414] CloseHandle (hObject=0x114) returned 1 [0043.414] CryptDestroyKey (hKey=0x5c9140) returned 1 [0043.414] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.414] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0043.414] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.414] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5d5b70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.414] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5d5b70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.414] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0043.414] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6733890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6733890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0043.414] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0043.415] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0043.415] CryptHashData (hHash=0x5c9140, pbData=0x32f9f5c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.415] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c8ec0) returned 1 [0043.415] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.415] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ea70) returned 0 [0043.415] GetLastError () returned 0xea [0043.415] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0043.415] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.415] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.416] SetEndOfFile (hFile=0x114) returned 1 [0043.417] CloseHandle (hObject=0x114) returned 1 [0043.417] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.417] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.417] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.417] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.417] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa66e75d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa66e75d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa670d730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.417] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5d5b70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.417] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa670d730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa670d730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa670d730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Internet Explorer.lnk.crypt", cAlternateFileName="INTERN~1.CRY")) returned 1 [0043.417] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa670d730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa670d730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa670d730, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Explorer.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 1 [0043.417] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa670d730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa670d730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6733890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Media Player.lnk.crypt", cAlternateFileName="WINDOW~2.CRY")) returned 1 [0043.417] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa670d730, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa670d730, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6733890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Media Player.lnk.crypt", cAlternateFileName="WINDOW~2.CRY")) returned 0 [0043.417] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.417] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6733890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6733890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0043.417] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0043.417] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6733890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6733890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6733890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 1 [0043.417] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6733890, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6733890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6733890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 0 [0043.417] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.417] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6733890, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6733890, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 0 [0043.417] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.417] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20455268, dwReserved1=0x52434e45, cFileName="Protect", cAlternateFileName="")) returned 1 [0043.417] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.418] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.418] CryptHashData (hHash=0x5c9200, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.418] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8fc0) returned 1 [0043.418] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.418] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f1a8) returned 0 [0043.418] GetLastError () returned 0xea [0043.418] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.419] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.419] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.420] SetEndOfFile (hFile=0xe8) returned 1 [0043.420] CloseHandle (hObject=0xe8) returned 1 [0043.420] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.420] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.420] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.420] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.420] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0043.420] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5d5b70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.420] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1 [0043.420] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.421] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.421] CryptHashData (hHash=0x5c9200, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.421] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9200, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0043.421] CryptDestroyHash (hHash=0x5c9200) returned 1 [0043.421] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.421] GetLastError () returned 0xea [0043.421] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.421] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.422] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.423] SetEndOfFile (hFile=0xf0) returned 1 [0043.423] CloseHandle (hObject=0xf0) returned 1 [0043.423] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0043.423] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.423] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0043.423] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.423] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x642afa0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1 [0043.424] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5d5b70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5d5b70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5d5b70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.424] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0043.424] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0043.424] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0043.424] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 0 [0043.424] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.424] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31363131, dwReserved1=0x34373533, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0043.424] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.424] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.424] CryptHashData (hHash=0x5c8fc0, pbData=0x33e2e20, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.424] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c8f80) returned 1 [0043.424] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.424] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f1a8) returned 0 [0043.424] GetLastError () returned 0xea [0043.425] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.425] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.425] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.426] SetEndOfFile (hFile=0xe8) returned 1 [0043.426] CloseHandle (hObject=0xe8) returned 1 [0043.426] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0043.426] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.426] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0043.426] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.427] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5fbcd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.427] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="My", cAlternateFileName="")) returned 1 [0043.427] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.427] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.427] CryptHashData (hHash=0x5c8fc0, pbData=0x1fe5350, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.427] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c9200) returned 1 [0043.427] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.427] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.427] GetLastError () returned 0xea [0043.427] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.428] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.428] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.429] SetEndOfFile (hFile=0xf0) returned 1 [0043.429] CloseHandle (hObject=0xf0) returned 1 [0043.429] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.429] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.429] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.430] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.430] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0043.430] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.430] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.430] CryptHashData (hHash=0x5c8fc0, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.430] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0043.430] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.430] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ecd8) returned 0 [0043.430] GetLastError () returned 0xea [0043.430] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.431] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.431] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.432] SetEndOfFile (hFile=0x108) returned 1 [0043.432] CloseHandle (hObject=0x108) returned 1 [0043.432] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.432] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.432] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.432] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.432] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5fbcd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.432] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5fbcd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.432] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.432] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="CRLs", cAlternateFileName="")) returned 1 [0043.433] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.433] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.433] CryptHashData (hHash=0x5c8ec0, pbData=0x32f9f5c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.433] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8fc0) returned 1 [0043.433] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.433] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ecd8) returned 0 [0043.433] GetLastError () returned 0xea [0043.433] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.434] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.434] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.435] SetEndOfFile (hFile=0x108) returned 1 [0043.435] CloseHandle (hObject=0x108) returned 1 [0043.435] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.435] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.435] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.435] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.435] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5fbcd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.435] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5fbcd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.435] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.435] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="CTLs", cAlternateFileName="")) returned 1 [0043.435] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.436] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.436] CryptHashData (hHash=0x5c8fc0, pbData=0x33e2dd0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.436] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0043.436] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.436] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ecd8) returned 0 [0043.436] GetLastError () returned 0xea [0043.436] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.436] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.437] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.438] SetEndOfFile (hFile=0x108) returned 1 [0043.438] CloseHandle (hObject=0x108) returned 1 [0043.438] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.438] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.438] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.438] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.438] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5fbcd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.438] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5fbcd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.438] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.438] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5fbcd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.438] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa5fbcd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa5fbcd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa5fbcd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.438] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.438] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="My", cAlternateFileName="")) returned 0 [0043.438] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0043.438] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows", cAlternateFileName="")) returned 1 [0043.439] CryptAcquireContextA (in: phProv=0x18f19c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f19c*=0x5d0e80) returned 1 [0043.439] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f154 | out: phHash=0x18f154) returned 1 [0043.439] CryptHashData (hHash=0x5c8f80, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.439] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18f198 | out: phKey=0x18f198*=0x5c9200) returned 1 [0043.439] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0043.439] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f1a8) returned 0 [0043.439] GetLastError () returned 0xea [0043.439] CryptEncrypt (in: hKey=0x5c9200, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f1a4*=0x260) returned 1 [0043.440] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0043.440] WriteFile (in: hFile=0xe8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ef28, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ef28*=0x7a0, lpOverlapped=0x0) returned 1 [0043.441] SetEndOfFile (hFile=0xe8) returned 1 [0043.441] CloseHandle (hObject=0xe8) returned 1 [0043.441] CryptDestroyKey (hKey=0x5c9200) returned 1 [0043.441] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.441] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9200 [0043.441] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.441] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe7f4ba2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Cookies", cAlternateFileName="")) returned 1 [0043.441] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.442] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.442] CryptHashData (hHash=0x5c8f80, pbData=0x33e2ad8, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.442] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0043.442] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0043.442] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.442] GetLastError () returned 0xea [0043.442] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.442] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.443] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.444] SetEndOfFile (hFile=0xf0) returned 1 [0043.444] CloseHandle (hObject=0xf0) returned 1 [0043.444] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.444] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.444] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.444] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.444] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa621e30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.444] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0043.444] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 0 [0043.444] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.444] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa621e30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.444] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0043.444] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.445] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.445] CryptHashData (hHash=0x5c8ec0, pbData=0x33e2e84, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.445] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0043.445] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.445] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.445] GetLastError () returned 0xea [0043.445] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.445] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\iecompatcache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.446] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.447] SetEndOfFile (hFile=0xf0) returned 1 [0043.447] CloseHandle (hObject=0xf0) returned 1 [0043.447] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0043.447] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.447] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0043.447] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.447] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa621e30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.447] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 1 [0043.447] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.448] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.448] CryptHashData (hHash=0x5c8ec0, pbData=0x33e2fdc, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.448] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8fc0) returned 1 [0043.448] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.448] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ecd8) returned 0 [0043.448] GetLastError () returned 0xea [0043.448] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.448] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\iecompatcache\\low\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.449] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.449] SetEndOfFile (hFile=0x108) returned 1 [0043.450] CloseHandle (hObject=0x108) returned 1 [0043.450] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.450] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.450] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.450] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.450] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa621e30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.450] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa621e30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.450] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.450] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 0 [0043.450] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0043.450] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x642afa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1 [0043.450] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.451] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.451] CryptHashData (hHash=0x5c8f80, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.451] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0043.451] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0043.451] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.451] GetLastError () returned 0xea [0043.451] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.451] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.452] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.452] SetEndOfFile (hFile=0xf0) returned 1 [0043.452] CloseHandle (hObject=0xf0) returned 1 [0043.453] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.453] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.453] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.453] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.453] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa621e30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.453] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe6c3ce0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3c000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="index.dat", cAlternateFileName="")) returned 1 [0043.453] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 1 [0043.453] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.453] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.454] CryptHashData (hHash=0x5c8f80, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.454] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0043.454] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0043.454] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ecd8) returned 0 [0043.454] GetLastError () returned 0xea [0043.454] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.454] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.454] WriteFile (in: hFile=0x108, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.455] SetEndOfFile (hFile=0x108) returned 1 [0043.455] CloseHandle (hObject=0x108) returned 1 [0043.455] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.455] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.456] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.456] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa621e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.456] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa621e30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.456] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa621e30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa621e30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.456] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.456] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 0 [0043.456] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.456] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa67599f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67599f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0043.456] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.457] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.457] CryptHashData (hHash=0x5c8fc0, pbData=0x33e2af4, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.457] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0043.457] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.457] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.457] GetLastError () returned 0xea [0043.457] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.457] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.457] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.458] SetEndOfFile (hFile=0xf0) returned 1 [0043.458] CloseHandle (hObject=0xf0) returned 1 [0043.459] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.459] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.459] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.459] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.459] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa67599f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa67599f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67599f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.459] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xe03, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1 [0043.459] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa647f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.459] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdd9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1 [0043.459] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1 [0043.459] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1 [0043.459] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0043.459] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.459] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0043.459] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.460] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.460] CryptHashData (hHash=0x5c8ec0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.460] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0043.460] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.460] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.460] GetLastError () returned 0xea [0043.460] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.460] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\network shortcuts\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.461] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.461] SetEndOfFile (hFile=0xf0) returned 1 [0043.461] CloseHandle (hObject=0xf0) returned 1 [0043.462] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.462] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.462] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.462] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.462] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa647f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.462] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa647f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.462] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.462] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0043.462] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.463] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.463] CryptHashData (hHash=0x5c8fc0, pbData=0x33e2f44, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.463] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0043.463] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.463] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.463] GetLastError () returned 0xea [0043.463] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.463] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\printer shortcuts\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.463] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.464] SetEndOfFile (hFile=0xf0) returned 1 [0043.464] CloseHandle (hObject=0xf0) returned 1 [0043.464] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.464] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.465] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.465] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.465] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa647f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.465] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa647f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.465] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.465] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0043.465] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.465] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.465] CryptHashData (hHash=0x5c8ec0, pbData=0x33e2f94, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.466] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0043.466] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.466] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.466] GetLastError () returned 0xea [0043.466] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.466] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\privacie\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.466] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.467] SetEndOfFile (hFile=0xf0) returned 1 [0043.467] CloseHandle (hObject=0xf0) returned 1 [0043.467] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.467] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.467] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.468] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.468] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa647f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.468] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 1 [0043.468] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.468] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.468] CryptHashData (hHash=0x5c8ec0, pbData=0x263f80, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.468] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8f80) returned 1 [0043.468] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.468] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ecd8) returned 0 [0043.468] GetLastError () returned 0xea [0043.469] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.469] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\privacie\\low\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.469] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.470] SetEndOfFile (hFile=0x108) returned 1 [0043.470] CloseHandle (hObject=0x108) returned 1 [0043.470] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0043.470] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.471] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0043.471] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa647f90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.471] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa647f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.471] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa647f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa647f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.471] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0043.471] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Low", cAlternateFileName="")) returned 0 [0043.471] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.471] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa677fb50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa677fb50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Recent", cAlternateFileName="")) returned 1 [0043.471] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.472] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.472] CryptHashData (hHash=0x5c8fc0, pbData=0x33e2fb4, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.472] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0043.472] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.472] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.472] GetLastError () returned 0xea [0043.472] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.472] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.472] WriteFile (in: hFile=0xf0, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.473] SetEndOfFile (hFile=0xf0) returned 1 [0043.473] CloseHandle (hObject=0xf0) returned 1 [0043.473] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0043.473] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.473] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0043.473] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.474] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x125b3d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0043.474] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.474] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.474] CryptHashData (hHash=0x5c8fc0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.474] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0043.474] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.474] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ecd8) returned 0 [0043.474] GetLastError () returned 0xea [0043.474] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.475] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.477] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.477] SetEndOfFile (hFile=0x108) returned 1 [0043.477] CloseHandle (hObject=0x108) returned 1 [0043.478] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.478] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.478] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.478] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.478] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x14bb620, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0043.478] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa66e0f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.478] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa66e0f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.478] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.478] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0043.478] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.479] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.479] CryptHashData (hHash=0x5c8ec0, pbData=0x33e2ff0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.479] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8fc0) returned 1 [0043.479] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.479] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ecd8) returned 0 [0043.479] GetLastError () returned 0xea [0043.479] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.479] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.480] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.481] SetEndOfFile (hFile=0x108) returned 1 [0043.481] CloseHandle (hObject=0x108) returned 1 [0043.481] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.481] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.481] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.481] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.481] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0043.481] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xc67cc5, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x3c12, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0043.481] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6404e40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0043.481] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa66e0f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.481] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa66e0f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.481] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.481] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67599f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa67599f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa677fb50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.482] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa66e0f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.482] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa66e0f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.482] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0043.482] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa67a5cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67a5cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="SendTo", cAlternateFileName="")) returned 1 [0043.482] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.482] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.482] CryptHashData (hHash=0x5c8f80, pbData=0x33e3000, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.482] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8fc0) returned 1 [0043.482] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0043.482] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.482] GetLastError () returned 0xea [0043.482] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.483] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.483] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.484] SetEndOfFile (hFile=0xf0) returned 1 [0043.486] CloseHandle (hObject=0xf0) returned 1 [0043.486] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.487] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.487] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.487] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa66e0f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.487] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeca9f1ef, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0043.487] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c45a701, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6404e40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0043.487] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa677fb50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa677fb50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa677fb50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.487] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63dece0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1 [0043.487] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa677fb50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa677fb50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67a5cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Fax Recipient.lnk.crypt", cAlternateFileName="FAXREC~1.CRY")) returned 1 [0043.487] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa66e0f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa66e0f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.487] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0043.487] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x63dece0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0043.487] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.487] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa67a5cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67a5cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0043.487] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.488] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.488] CryptHashData (hHash=0x5c8fc0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.488] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0043.488] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.488] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.488] GetLastError () returned 0xea [0043.488] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.488] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.490] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.491] SetEndOfFile (hFile=0xf0) returned 1 [0043.491] CloseHandle (hObject=0xf0) returned 1 [0043.491] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0043.491] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.491] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0043.491] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.491] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67a5cb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa67a5cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67a5cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.491] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa694250, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.491] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa688a4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa688a4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Programs", cAlternateFileName="")) returned 1 [0043.491] CryptAcquireContextA (in: phProv=0x18eccc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18eccc*=0x5d0e80) returned 1 [0043.492] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ec84 | out: phHash=0x18ec84) returned 1 [0043.492] CryptHashData (hHash=0x5c8fc0, pbData=0x33e2ea8, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.492] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ecc8 | out: phKey=0x18ecc8*=0x5c8ec0) returned 1 [0043.492] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.492] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd8*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ecd8) returned 0 [0043.492] GetLastError () returned 0xea [0043.492] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ecd4*=0x260) returned 1 [0043.492] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x108 [0043.492] WriteFile (in: hFile=0x108, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ea58, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ea58*=0x7a0, lpOverlapped=0x0) returned 1 [0043.493] SetEndOfFile (hFile=0x108) returned 1 [0043.493] CloseHandle (hObject=0x108) returned 1 [0043.493] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.494] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.494] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.494] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.494] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6864390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6864390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0043.494] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0043.494] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0043.494] CryptHashData (hHash=0x5c8fc0, pbData=0x33e2ef8, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.494] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9140) returned 1 [0043.494] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.494] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ea70) returned 0 [0043.494] GetLastError () returned 0xea [0043.494] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0043.495] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.495] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.496] SetEndOfFile (hFile=0x114) returned 1 [0043.496] CloseHandle (hObject=0x114) returned 1 [0043.496] CryptDestroyKey (hKey=0x5c9140) returned 1 [0043.496] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.496] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0043.496] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.497] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa67f1f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67f1f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0043.497] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0043.497] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0043.497] CryptHashData (hHash=0x5c8fc0, pbData=0x282a1c, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.497] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c9080) returned 1 [0043.497] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.497] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18e808) returned 0 [0043.497] GetLastError () returned 0xea [0043.497] CryptEncrypt (in: hKey=0x5c9080, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18e804*=0x260) returned 1 [0043.498] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.498] WriteFile (in: hFile=0x104, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0043.499] SetEndOfFile (hFile=0x104) returned 1 [0043.499] CloseHandle (hObject=0x104) returned 1 [0043.499] CryptDestroyKey (hKey=0x5c9080) returned 1 [0043.499] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.499] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9080 [0043.499] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.499] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67a5cb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa67a5cb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67a5cb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.499] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67cbe10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa67cbe10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67cbe10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Ease of Access.lnk.crypt", cAlternateFileName="EASEOF~1.CRY")) returned 1 [0043.499] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa694250, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.499] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67cbe10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa67cbe10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67cbe10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Magnify.lnk.crypt", cAlternateFileName="MAGNIF~1.CRY")) returned 1 [0043.499] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67cbe10, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa67cbe10, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67cbe10, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Narrator.lnk.crypt", cAlternateFileName="NARRAT~1.CRY")) returned 1 [0043.499] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67f1f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa67f1f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67f1f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="On-Screen Keyboard.lnk.crypt", cAlternateFileName="ON-SCR~1.CRY")) returned 1 [0043.499] FindNextFileA (in: hFindFile=0x5c9080, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67f1f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa67f1f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67f1f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="On-Screen Keyboard.lnk.crypt", cAlternateFileName="ON-SCR~1.CRY")) returned 0 [0043.500] FindClose (in: hFindFile=0x5c9080 | out: hFindFile=0x5c9080) returned 1 [0043.500] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67f1f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa67f1f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67f1f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="Command Prompt.lnk.crypt", cAlternateFileName="COMMAN~1.CRY")) returned 1 [0043.500] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa67f1f70, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa67f1f70, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa67f1f70, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.500] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa694250, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.500] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68180d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa68180d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa68180d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="Notepad.lnk.crypt", cAlternateFileName="NOTEPA~1.CRY")) returned 1 [0043.500] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68180d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa68180d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa68180d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="Run.lnk.crypt", cAlternateFileName="RUNLNK~1.CRY")) returned 1 [0043.500] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6864390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6864390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0043.500] CryptAcquireContextA (in: phProv=0x18e7fc, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18e7fc*=0x5d0e80) returned 1 [0043.500] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18e7b4 | out: phHash=0x18e7b4) returned 1 [0043.500] CryptHashData (hHash=0x5c9080, pbData=0x33e2fc0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.500] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9080, dwFlags=0x0, phKey=0x18e7f8 | out: phKey=0x18e7f8*=0x5c8fc0) returned 1 [0043.500] CryptDestroyHash (hHash=0x5c9080) returned 1 [0043.500] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18e808*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18e808) returned 0 [0043.500] GetLastError () returned 0xea [0043.501] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18e804*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18e804*=0x260) returned 1 [0043.501] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0043.501] WriteFile (in: hFile=0x104, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e588, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e588*=0x7a0, lpOverlapped=0x0) returned 1 [0043.502] SetEndOfFile (hFile=0x104) returned 1 [0043.502] CloseHandle (hObject=0x104) returned 1 [0043.502] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.502] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.502] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.502] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.502] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68180d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa68180d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa68180d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="computer.lnk.crypt", cAlternateFileName="COMPUT~1.CRY")) returned 1 [0043.502] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa683e230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa683e230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa683e230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Control Panel.lnk.crypt", cAlternateFileName="CONTRO~1.CRY")) returned 1 [0043.502] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa683e230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa683e230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa683e230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.502] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa694250, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.502] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa683e230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa683e230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa683e230, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5db, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Internet Explorer (No Add-ons).lnk.crypt", cAlternateFileName="INTERN~1.CRY")) returned 1 [0043.502] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa683e230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa683e230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6864390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Private Character Editor.lnk.crypt", cAlternateFileName="PRIVAT~1.CRY")) returned 1 [0043.503] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18e7a0 | out: lpFindFileData=0x18e7a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa683e230, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa683e230, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6864390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Private Character Editor.lnk.crypt", cAlternateFileName="PRIVAT~1.CRY")) returned 0 [0043.503] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.503] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6864390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6864390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6864390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 1 [0043.503] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6864390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6864390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6864390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk.crypt", cAlternateFileName="WINDOW~1.CRY")) returned 0 [0043.503] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0043.503] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6864390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6864390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f6c, dwReserved1=0x6e6c2e72, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0043.503] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0043.503] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0043.503] CryptHashData (hHash=0x5c9140, pbData=0x33e2fe0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.503] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c8fc0) returned 1 [0043.503] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.503] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ea70) returned 0 [0043.503] GetLastError () returned 0xea [0043.504] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0043.504] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.504] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.505] SetEndOfFile (hFile=0x114) returned 1 [0043.505] CloseHandle (hObject=0x114) returned 1 [0043.505] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.505] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.505] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.505] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.505] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6864390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6864390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6864390, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.505] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa6ba3b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.505] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa6ba3b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.506] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.506] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6864390, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6864390, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa688a4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.506] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa694250, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa694250, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa694250, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.506] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa688a4f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa688a4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa688a4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Internet Explorer (64-bit).lnk.crypt", cAlternateFileName="INTERN~1.CRY")) returned 1 [0043.506] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa688a4f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa688a4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa688a4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Internet Explorer.lnk.crypt", cAlternateFileName="INTERN~2.CRY")) returned 1 [0043.506] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa68b0650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa68b0650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0043.506] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0043.506] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0043.506] CryptHashData (hHash=0x5c8fc0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.506] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8fc0, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c9140) returned 1 [0043.506] CryptDestroyHash (hHash=0x5c8fc0) returned 1 [0043.506] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ea70) returned 0 [0043.506] GetLastError () returned 0xea [0043.506] CryptEncrypt (in: hKey=0x5c9140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0043.507] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.509] WriteFile (in: hFile=0x114, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.509] SetEndOfFile (hFile=0x114) returned 1 [0043.510] CloseHandle (hObject=0x114) returned 1 [0043.510] CryptDestroyKey (hKey=0x5c9140) returned 1 [0043.510] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.510] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9140 [0043.510] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.510] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa688a4f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa688a4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa688a4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.510] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68b0650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa68b0650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa68b0650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Help.lnk.crypt", cAlternateFileName="HELPLN~1.CRY")) returned 1 [0043.510] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa6ba3b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.510] FindNextFileA (in: hFindFile=0x5c9140, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa6ba3b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.510] FindClose (in: hFindFile=0x5c9140 | out: hFindFile=0x5c9140) returned 1 [0043.510] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa68b0650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa68b0650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Startup", cAlternateFileName="")) returned 1 [0043.510] CryptAcquireContextA (in: phProv=0x18ea64, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ea64*=0x5d0e80) returned 1 [0043.511] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18ea1c | out: phHash=0x18ea1c) returned 1 [0043.511] CryptHashData (hHash=0x5c9140, pbData=0x33e2ef4, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.511] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9140, dwFlags=0x0, phKey=0x18ea60 | out: phKey=0x18ea60*=0x5c8fc0) returned 1 [0043.511] CryptDestroyHash (hHash=0x5c9140) returned 1 [0043.511] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ea70*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ea70) returned 0 [0043.511] GetLastError () returned 0xea [0043.511] CryptEncrypt (in: hKey=0x5c8fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ea6c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ea6c*=0x260) returned 1 [0043.511] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0043.511] WriteFile (in: hFile=0x114, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18e7f0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18e7f0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.512] SetEndOfFile (hFile=0x114) returned 1 [0043.512] CloseHandle (hObject=0x114) returned 1 [0043.512] CryptDestroyKey (hKey=0x5c8fc0) returned 1 [0043.512] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.513] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8fc0 [0043.513] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.513] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68b0650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa68b0650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa68b0650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.513] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa6ba3b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.513] FindNextFileA (in: hFindFile=0x5c8fc0, lpFindFileData=0x18ea08 | out: lpFindFileData=0x18ea08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa6ba3b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.513] FindClose (in: hFindFile=0x5c8fc0 | out: hFindFile=0x5c8fc0) returned 1 [0043.513] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18ec70 | out: lpFindFileData=0x18ec70*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa68b0650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa68b0650, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Startup", cAlternateFileName="")) returned 0 [0043.513] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.513] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa688a4f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa688a4f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Programs", cAlternateFileName="")) returned 0 [0043.513] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0043.513] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0043.513] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.514] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.514] CryptHashData (hHash=0x5c8f80, pbData=0x33e2f34, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.514] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f80, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8ec0) returned 1 [0043.514] CryptDestroyHash (hHash=0x5c8f80) returned 1 [0043.514] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.514] GetLastError () returned 0xea [0043.514] CryptEncrypt (in: hKey=0x5c8ec0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.514] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\templates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.515] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.515] SetEndOfFile (hFile=0xf0) returned 1 [0043.515] CloseHandle (hObject=0xf0) returned 1 [0043.516] CryptDestroyKey (hKey=0x5c8ec0) returned 1 [0043.516] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.516] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8ec0 [0043.516] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.516] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa6ba3b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.516] FindNextFileA (in: hFindFile=0x5c8ec0, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa6ba3b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6ba3b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6ba3b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.516] FindClose (in: hFindFile=0x5c8ec0 | out: hFindFile=0x5c8ec0) returned 1 [0043.516] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6948bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6948bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Themes", cAlternateFileName="")) returned 1 [0043.516] CryptAcquireContextA (in: phProv=0x18ef34, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18ef34*=0x5d0e80) returned 1 [0043.517] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18eeec | out: phHash=0x18eeec) returned 1 [0043.517] CryptHashData (hHash=0x5c8ec0, pbData=0x33e2f94, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.517] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8ec0, dwFlags=0x0, phKey=0x18ef30 | out: phKey=0x18ef30*=0x5c8f80) returned 1 [0043.517] CryptDestroyHash (hHash=0x5c8ec0) returned 1 [0043.517] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef40*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18ef40) returned 0 [0043.517] GetLastError () returned 0xea [0043.517] CryptEncrypt (in: hKey=0x5c8f80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18ef3c*=0x260) returned 1 [0043.517] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0043.518] WriteFile (in: hFile=0xf0, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18ecc0, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18ecc0*=0x7a0, lpOverlapped=0x0) returned 1 [0043.519] SetEndOfFile (hFile=0xf0) returned 1 [0043.519] CloseHandle (hObject=0xf0) returned 1 [0043.519] CryptDestroyKey (hKey=0x5c8f80) returned 1 [0043.519] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.519] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6e0510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f80 [0043.519] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6e0510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.519] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa6e0510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6e0510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.519] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa68b0650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa68b0650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6948bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9b944, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="TranscodedWallpaper.jpg.crypt", cAlternateFileName="TRANSC~1.CRY")) returned 1 [0043.519] FindNextFileA (in: hFindFile=0x5c8f80, lpFindFileData=0x18eed8 | out: lpFindFileData=0x18eed8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa68b0650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa68b0650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6948bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x9b944, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="TranscodedWallpaper.jpg.crypt", cAlternateFileName="TRANSC~1.CRY")) returned 0 [0043.519] FindClose (in: hFindFile=0x5c8f80 | out: hFindFile=0x5c8f80) returned 1 [0043.519] FindNextFileA (in: hFindFile=0x5c9200, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6948bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6948bd0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Themes", cAlternateFileName="")) returned 0 [0043.519] FindClose (in: hFindFile=0x5c9200 | out: hFindFile=0x5c9200) returned 1 [0043.519] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f3a8 | out: lpFindFileData=0x18f3a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Windows", cAlternateFileName="")) returned 0 [0043.519] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.519] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0043.519] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.519] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Roaming", cAlternateFileName="")) returned 0 [0043.519] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0043.519] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52434e45, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0043.519] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.520] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.520] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.520] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.520] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.520] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f8e0) returned 0 [0043.520] GetLastError () returned 0xea [0043.520] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.521] CreateFileA (lpFileName="C:\\Users\\Default\\Application Data\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\application data\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.521] WriteFile (in: hFile=0xdc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.521] SetEndOfFile (hFile=0xdc) returned 1 [0043.521] CloseHandle (hObject=0xdc) returned 1 [0043.521] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.521] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.521] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="")) returned 0xffffffff [0043.521] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa696ed30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa696ed30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="Contacts", cAlternateFileName="")) returned 1 [0043.521] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.522] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.522] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.522] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8f40) returned 1 [0043.522] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.522] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1bdc*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1bdc, pdwDataLen=0x18f8e0) returned 0 [0043.522] GetLastError () returned 0xea [0043.522] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1bdc*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1bdc*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.522] CreateFileA (lpFileName="C:\\Users\\Default\\Contacts\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\contacts\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.524] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.525] SetEndOfFile (hFile=0xdc) returned 1 [0043.525] CloseHandle (hObject=0xdc) returned 1 [0043.525] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0043.525] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.525] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Contacts\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6e0510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0043.525] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6e0510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.525] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0043.525] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6948bd0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6948bd0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa696ed30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.525] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa6e0510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6e0510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.525] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa6e0510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6e0510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.526] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0043.526] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52434e45, cFileName="Cookies", cAlternateFileName="")) returned 1 [0043.526] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.526] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.526] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.526] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.526] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.526] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e3000*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e3000, pdwDataLen=0x18f8e0) returned 0 [0043.526] GetLastError () returned 0xea [0043.526] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e3000*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e3000*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.527] CreateFileA (lpFileName="C:\\Users\\Default\\Cookies\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\cookies\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.527] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.527] SetEndOfFile (hFile=0xdc) returned 1 [0043.527] CloseHandle (hObject=0xdc) returned 1 [0043.527] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.527] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.527] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="")) returned 0xffffffff [0043.527] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa696ed30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa696ed30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="Desktop", cAlternateFileName="")) returned 1 [0043.527] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.528] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.528] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.528] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8f40) returned 1 [0043.528] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.528] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f9c*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2f9c, pdwDataLen=0x18f8e0) returned 0 [0043.528] GetLastError () returned 0xea [0043.528] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f9c*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2f9c*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.528] CreateFileA (lpFileName="C:\\Users\\Default\\Desktop\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\desktop\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.529] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.530] SetEndOfFile (hFile=0xdc) returned 1 [0043.530] CloseHandle (hObject=0xdc) returned 1 [0043.530] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0043.530] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.530] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6e0510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0043.530] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6e0510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.530] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa696ed30, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa696ed30, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa696ed30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.530] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa6e0510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6e0510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.530] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa6e0510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6e0510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.530] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0043.530] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6994e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6994e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0043.530] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.531] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.531] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.531] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.531] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.531] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2458*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2458, pdwDataLen=0x18f8e0) returned 0 [0043.531] GetLastError () returned 0xea [0043.531] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2458*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2458*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.531] CreateFileA (lpFileName="C:\\Users\\Default\\Documents\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\documents\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.532] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.533] SetEndOfFile (hFile=0xdc) returned 1 [0043.533] CloseHandle (hObject=0xdc) returned 1 [0043.533] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.533] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.533] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6e0510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.533] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa6e0510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.533] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6994e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6994e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6994e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.533] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa6e0510, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa6e0510, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.533] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x5a0000, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0043.533] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.534] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.534] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.534] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c91c0) returned 1 [0043.534] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.534] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18f678) returned 0 [0043.534] GetLastError () returned 0xea [0043.534] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.534] CreateFileA (lpFileName="C:\\Users\\Default\\Documents\\My Music\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\documents\\my music\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.535] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.536] SetEndOfFile (hFile=0xf8) returned 1 [0043.536] CloseHandle (hObject=0xf8) returned 1 [0043.536] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.536] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.536] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f60c, ftLastWriteTime.dwHighDateTime=0x18f608, nFileSizeHigh=0x18f650, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x90\x5c")) returned 0xffffffff [0043.536] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0043.536] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.537] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.537] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.537] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0043.537] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.537] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e19ec*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e19ec, pdwDataLen=0x18f678) returned 0 [0043.537] GetLastError () returned 0xea [0043.537] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e19ec*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e19ec*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.537] CreateFileA (lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\documents\\my pictures\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.537] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.538] SetEndOfFile (hFile=0xf8) returned 1 [0043.538] CloseHandle (hObject=0xf8) returned 1 [0043.538] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0043.538] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.538] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f60c, ftLastWriteTime.dwHighDateTime=0x18f608, nFileSizeHigh=0x18f650, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x90\x5c")) returned 0xffffffff [0043.538] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0043.539] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.539] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.539] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.539] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c91c0) returned 1 [0043.539] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.539] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e193c, pdwDataLen=0x18f678) returned 0 [0043.539] GetLastError () returned 0xea [0043.539] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e193c*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e193c*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.540] CreateFileA (lpFileName="C:\\Users\\Default\\Documents\\My Videos\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\documents\\my videos\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.540] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.541] SetEndOfFile (hFile=0xf8) returned 1 [0043.541] CloseHandle (hObject=0xf8) returned 1 [0043.541] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.541] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.541] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f60c, ftLastWriteTime.dwHighDateTime=0x18f608, nFileSizeHigh=0x18f650, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x90\x5c")) returned 0xffffffff [0043.541] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0043.541] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.541] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6994e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6994e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0043.541] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.542] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.542] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.542] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c91c0) returned 1 [0043.542] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.542] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2ef8*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2ef8, pdwDataLen=0x18f8e0) returned 0 [0043.542] GetLastError () returned 0xea [0043.542] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2ef8*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2ef8*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.542] CreateFileA (lpFileName="C:\\Users\\Default\\Downloads\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\downloads\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.543] WriteFile (in: hFile=0xdc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.543] SetEndOfFile (hFile=0xdc) returned 1 [0043.544] CloseHandle (hObject=0xdc) returned 1 [0043.544] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.544] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.544] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.544] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.544] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6994e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6994e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6994e90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.544] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa706670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.544] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa706670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.544] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.544] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa69baff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa69baff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0043.544] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.545] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.545] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.545] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.545] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.545] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1f28*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1f28, pdwDataLen=0x18f8e0) returned 0 [0043.545] GetLastError () returned 0xea [0043.545] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1f28*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1f28*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.545] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\favorites\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.545] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.546] SetEndOfFile (hFile=0xdc) returned 1 [0043.546] CloseHandle (hObject=0xdc) returned 1 [0043.546] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.546] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.547] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.547] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.547] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6994e90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6994e90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa69baff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.547] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa706670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.547] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa69baff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa69baff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Links", cAlternateFileName="")) returned 1 [0043.547] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.547] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.547] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.547] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0043.547] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.547] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18f678) returned 0 [0043.547] GetLastError () returned 0xea [0043.548] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.548] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\favorites\\links\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.550] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.551] SetEndOfFile (hFile=0xf8) returned 1 [0043.551] CloseHandle (hObject=0xf8) returned 1 [0043.551] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0043.551] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.551] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0043.551] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.551] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69baff0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa69baff0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa69baff0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.551] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa706670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.551] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0043.551] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0043.551] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0043.551] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x752e7972, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0043.551] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.552] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.552] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.552] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c91c0) returned 1 [0043.552] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.552] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f08*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2f08, pdwDataLen=0x18f678) returned 0 [0043.552] GetLastError () returned 0xea [0043.552] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2f08*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2f08*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.552] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.553] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.554] SetEndOfFile (hFile=0xf8) returned 1 [0043.554] CloseHandle (hObject=0xf8) returned 1 [0043.554] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.554] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.554] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.554] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.554] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa72c7d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.554] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0043.554] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0043.554] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0043.555] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0043.555] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0043.555] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0043.555] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.555] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x6c72752e, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0043.555] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.555] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.555] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.555] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0043.555] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.555] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2ee8*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2ee8, pdwDataLen=0x18f678) returned 0 [0043.555] GetLastError () returned 0xea [0043.555] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2ee8*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2ee8*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.556] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\favorites\\msn websites\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.557] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.558] SetEndOfFile (hFile=0xf8) returned 1 [0043.558] CloseHandle (hObject=0xf8) returned 1 [0043.558] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0043.558] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.558] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0043.558] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.558] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa72c7d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.558] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0043.558] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0043.558] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0043.558] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0043.558] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0043.558] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0043.558] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0043.558] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0043.558] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0043.558] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.559] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.559] CryptHashData (hHash=0x5c8f40, pbData=0x33e22dc, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.559] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c91c0) returned 1 [0043.559] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.559] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2074*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2074, pdwDataLen=0x18f678) returned 0 [0043.559] GetLastError () returned 0xea [0043.559] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2074*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2074*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.559] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\favorites\\windows live\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.560] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.561] SetEndOfFile (hFile=0xf8) returned 1 [0043.561] CloseHandle (hObject=0xf8) returned 1 [0043.561] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.561] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.561] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.561] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.562] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0043.562] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa72c7d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.562] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0043.562] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0043.562] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0043.562] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0043.562] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.562] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0043.562] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.562] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1d1650, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa1d1650, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa1f77b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x69736265, dwReserved1=0x52736574, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.562] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6a072b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a072b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69736265, dwReserved1=0x52736574, cFileName="Links", cAlternateFileName="")) returned 1 [0043.562] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.562] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.563] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.563] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c91c0) returned 1 [0043.563] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.563] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18f8e0) returned 0 [0043.563] GetLastError () returned 0xea [0043.563] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.563] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\links\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.563] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.564] SetEndOfFile (hFile=0xdc) returned 1 [0043.565] CloseHandle (hObject=0xdc) returned 1 [0043.565] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.565] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.565] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.565] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa72c7d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.565] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69e1150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa69e1150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa69e1150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.565] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69e1150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa69e1150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa69e1150, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop.lnk.crypt", cAlternateFileName="DESKTO~2.CRY")) returned 1 [0043.565] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69e1150, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa69e1150, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a072b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Downloads.lnk.crypt", cAlternateFileName="DOWNLO~1.CRY")) returned 1 [0043.565] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa72c7d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa72c7d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa752930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.565] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a072b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a072b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a072b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RecentPlaces.lnk.crypt", cAlternateFileName="RECENT~1.CRY")) returned 1 [0043.565] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a072b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a072b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a072b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RecentPlaces.lnk.crypt", cAlternateFileName="RECENT~1.CRY")) returned 0 [0043.565] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.565] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x72632e6b, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0043.565] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.566] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.566] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.566] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c91c0) returned 1 [0043.566] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.566] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18f8e0) returned 0 [0043.566] GetLastError () returned 0xea [0043.566] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.566] CreateFileA (lpFileName="C:\\Users\\Default\\Local Settings\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\local settings\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.566] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.566] SetEndOfFile (hFile=0xdc) returned 1 [0043.567] CloseHandle (hObject=0xdc) returned 1 [0043.567] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.567] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.567] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="")) returned 0xffffffff [0043.567] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6a072b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a072b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="Music", cAlternateFileName="")) returned 1 [0043.567] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.567] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.567] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.567] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.567] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.567] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2d4c*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2d4c, pdwDataLen=0x18f8e0) returned 0 [0043.568] GetLastError () returned 0xea [0043.568] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2d4c*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2d4c*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.568] CreateFileA (lpFileName="C:\\Users\\Default\\Music\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\music\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.568] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.568] SetEndOfFile (hFile=0xdc) returned 1 [0043.568] CloseHandle (hObject=0xdc) returned 1 [0043.568] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.568] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.568] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.568] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.568] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a072b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a072b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a072b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.568] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa706670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa752930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.568] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa706670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa752930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.568] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.569] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52434e45, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0043.569] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.569] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.569] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.569] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.569] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.569] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18f8e0) returned 0 [0043.569] GetLastError () returned 0xea [0043.569] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.570] CreateFileA (lpFileName="C:\\Users\\Default\\My Documents\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\my documents\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.570] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.570] SetEndOfFile (hFile=0xdc) returned 1 [0043.570] CloseHandle (hObject=0xdc) returned 1 [0043.570] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.570] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.570] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="")) returned 0xffffffff [0043.570] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e, cFileName="NetHood", cAlternateFileName="")) returned 1 [0043.570] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.571] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.571] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.571] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c91c0) returned 1 [0043.571] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.571] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1974, pdwDataLen=0x18f8e0) returned 0 [0043.571] GetLastError () returned 0xea [0043.571] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1974*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1974*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.571] CreateFileA (lpFileName="C:\\Users\\Default\\NetHood\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\nethood\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.571] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.571] SetEndOfFile (hFile=0xdc) returned 1 [0043.572] CloseHandle (hObject=0xdc) returned 1 [0043.572] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.572] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.572] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="")) returned 0xffffffff [0043.572] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0x3, dwReserved1=0x18e, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0043.572] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x3, dwReserved1=0x18e, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1 [0043.572] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x674ac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0x3, dwReserved1=0x18e, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0043.572] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0043.572] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x3, dwReserved1=0x18e, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0043.572] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x3, dwReserved1=0x18e, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0043.572] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x3, dwReserved1=0x18e, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0043.572] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a072b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a072b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a072b0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x3, dwReserved1=0x18e, cFileName="ntuser.ini.crypt", cAlternateFileName="NTUSER~1.CRY")) returned 1 [0043.572] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6a2d410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a2d410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="Pictures", cAlternateFileName="")) returned 1 [0043.572] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.573] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.573] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.573] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.573] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.573] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2e70*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2e70, pdwDataLen=0x18f8e0) returned 0 [0043.573] GetLastError () returned 0xea [0043.573] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2e70*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2e70*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.573] CreateFileA (lpFileName="C:\\Users\\Default\\Pictures\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\pictures\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.573] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.573] SetEndOfFile (hFile=0xdc) returned 1 [0043.573] CloseHandle (hObject=0xdc) returned 1 [0043.573] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.573] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.574] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.574] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.574] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a2d410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a2d410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a2d410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.574] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa706670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa752930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.574] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa706670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa752930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.574] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.574] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x52434e45, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0043.574] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.574] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.574] CryptHashData (hHash=0x5c90c0, pbData=0x33e2df8, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.574] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c91c0) returned 1 [0043.575] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.575] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2e30*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2e30, pdwDataLen=0x18f8e0) returned 0 [0043.575] GetLastError () returned 0xea [0043.575] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2e30*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2e30*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.575] CreateFileA (lpFileName="C:\\Users\\Default\\PrintHood\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\printhood\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.575] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.575] SetEndOfFile (hFile=0xdc) returned 1 [0043.575] CloseHandle (hObject=0xdc) returned 1 [0043.575] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.575] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.575] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="")) returned 0xffffffff [0043.575] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e, cFileName="Recent", cAlternateFileName="")) returned 1 [0043.575] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.576] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.576] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.576] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.576] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.576] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2458*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2458, pdwDataLen=0x18f8e0) returned 0 [0043.576] GetLastError () returned 0xea [0043.576] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2458*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2458*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.576] CreateFileA (lpFileName="C:\\Users\\Default\\Recent\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\recent\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.577] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.577] SetEndOfFile (hFile=0xdc) returned 1 [0043.577] CloseHandle (hObject=0xdc) returned 1 [0043.577] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.577] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.577] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="")) returned 0xffffffff [0043.577] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6a2d410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a2d410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0043.577] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.578] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.578] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.578] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c91c0) returned 1 [0043.578] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.578] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18f8e0) returned 0 [0043.578] GetLastError () returned 0xea [0043.578] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.578] CreateFileA (lpFileName="C:\\Users\\Default\\Saved Games\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\saved games\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.579] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.580] SetEndOfFile (hFile=0xdc) returned 1 [0043.580] CloseHandle (hObject=0xdc) returned 1 [0043.580] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.580] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.580] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa752930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa752930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.580] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa752930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa752930, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.580] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a2d410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a2d410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a2d410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.580] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa752930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa752930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa778a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.580] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa752930, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa752930, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa778a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.580] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.580] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa6a2d410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a2d410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Searches", cAlternateFileName="")) returned 1 [0043.580] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.581] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.581] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.581] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.581] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.581] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2db8*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2db8, pdwDataLen=0x18f8e0) returned 0 [0043.581] GetLastError () returned 0xea [0043.581] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2db8*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2db8*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.581] CreateFileA (lpFileName="C:\\Users\\Default\\Searches\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\searches\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.581] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.582] SetEndOfFile (hFile=0xdc) returned 1 [0043.582] CloseHandle (hObject=0xdc) returned 1 [0043.583] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.583] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.583] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Searches\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa778a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa778a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.583] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xaa778a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa778a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.583] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a2d410, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a2d410, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a2d410, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.583] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0043.583] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa778a90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa778a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa778a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.583] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0043.583] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0043.583] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.583] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="SendTo", cAlternateFileName="")) returned 1 [0043.583] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.584] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.584] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.584] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c91c0) returned 1 [0043.584] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.584] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2da0*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2da0, pdwDataLen=0x18f8e0) returned 0 [0043.584] GetLastError () returned 0xea [0043.584] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2da0*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2da0*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.584] CreateFileA (lpFileName="C:\\Users\\Default\\SendTo\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\sendto\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.584] WriteFile (in: hFile=0xdc, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.584] SetEndOfFile (hFile=0xdc) returned 1 [0043.584] CloseHandle (hObject=0xdc) returned 1 [0043.584] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.584] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.584] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="")) returned 0xffffffff [0043.585] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0043.585] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.585] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.585] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.585] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.585] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.585] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2094*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2094, pdwDataLen=0x18f8e0) returned 0 [0043.585] GetLastError () returned 0xea [0043.585] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2094*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2094*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.586] CreateFileA (lpFileName="C:\\Users\\Default\\Start Menu\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\start menu\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.586] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.586] SetEndOfFile (hFile=0xdc) returned 1 [0043.586] CloseHandle (hObject=0xdc) returned 1 [0043.586] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.586] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.586] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="")) returned 0xffffffff [0043.586] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0043.586] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.587] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.587] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.587] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c91c0) returned 1 [0043.587] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.587] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2e90*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2e90, pdwDataLen=0x18f8e0) returned 0 [0043.587] GetLastError () returned 0xea [0043.587] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2e90*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2e90*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.587] CreateFileA (lpFileName="C:\\Users\\Default\\Templates\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\templates\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.587] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.587] SetEndOfFile (hFile=0xdc) returned 1 [0043.588] CloseHandle (hObject=0xdc) returned 1 [0043.588] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.588] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.588] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f874, ftLastWriteTime.dwHighDateTime=0x18f870, nFileSizeHigh=0x18f8b8, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="")) returned 0xffffffff [0043.588] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="Videos", cAlternateFileName="")) returned 1 [0043.588] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.588] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.588] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.588] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.589] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.589] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2e68*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2e68, pdwDataLen=0x18f8e0) returned 0 [0043.589] GetLastError () returned 0xea [0043.589] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2e68*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2e68*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.589] CreateFileA (lpFileName="C:\\Users\\Default\\Videos\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default\\videos\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.589] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.589] SetEndOfFile (hFile=0xdc) returned 1 [0043.589] CloseHandle (hObject=0xdc) returned 1 [0043.589] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.589] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.589] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.589] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.589] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a53570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a53570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a53570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.589] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa706670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa778a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.590] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa706670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa778a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.590] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.590] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa706670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa706670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="Videos", cAlternateFileName="")) returned 0 [0043.590] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0043.590] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x64623874, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0043.590] CryptAcquireContextA (in: phProv=0x18fb3c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18fb3c*=0x5d0e80) returned 1 [0043.590] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18faf4 | out: phHash=0x18faf4) returned 1 [0043.590] CryptHashData (hHash=0x5c9100, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.590] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c9100, dwFlags=0x0, phKey=0x18fb38 | out: phKey=0x18fb38*=0x5c91c0) returned 1 [0043.590] CryptDestroyHash (hHash=0x5c9100) returned 1 [0043.590] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2458*, pdwDataLen=0x18fb48*=0x258, dwBufLen=0x258 | out: pbData=0x33e2458, pdwDataLen=0x18fb48) returned 0 [0043.590] GetLastError () returned 0xea [0043.590] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2458*, pdwDataLen=0x18fb44*=0x258, dwBufLen=0x260 | out: pbData=0x33e2458*, pdwDataLen=0x18fb44*=0x260) returned 1 [0043.591] CreateFileA (lpFileName="C:\\Users\\Default User\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\default user\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0043.591] WriteFile (in: hFile=0xf4, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f8c8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f8c8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.591] SetEndOfFile (hFile=0xf4) returned 1 [0043.591] CloseHandle (hObject=0xf4) returned 1 [0043.591] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.591] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.591] FindFirstFileA (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18fadc, ftLastWriteTime.dwHighDateTime=0x18fad8, nFileSizeHigh=0x18fb20, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\x80\x8e\x5c")) returned 0xffffffff [0043.591] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a53570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a53570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a53570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x3, dwReserved1=0x18e, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.591] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6a796d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a796d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="Public", cAlternateFileName="")) returned 1 [0043.591] CryptAcquireContextA (in: phProv=0x18fb3c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18fb3c*=0x5d0e80) returned 1 [0043.592] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18faf4 | out: phHash=0x18faf4) returned 1 [0043.592] CryptHashData (hHash=0x5c91c0, pbData=0x24edf0, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.592] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18fb38 | out: phKey=0x18fb38*=0x5c9100) returned 1 [0043.592] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.592] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18fb48*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18fb48) returned 0 [0043.592] GetLastError () returned 0xea [0043.592] CryptEncrypt (in: hKey=0x5c9100, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18fb44*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18fb44*=0x260) returned 1 [0043.592] CreateFileA (lpFileName="C:\\Users\\Public\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0043.593] WriteFile (in: hFile=0xf4, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f8c8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f8c8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.594] SetEndOfFile (hFile=0xf4) returned 1 [0043.594] CloseHandle (hObject=0xf4) returned 1 [0043.594] CryptDestroyKey (hKey=0x5c9100) returned 1 [0043.594] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.594] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa778a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa778a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c9100 [0043.594] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa778a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa778a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.594] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desktop", cAlternateFileName="")) returned 1 [0043.594] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.595] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.595] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.595] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.595] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.595] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1d44*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1d44, pdwDataLen=0x18f8e0) returned 0 [0043.595] GetLastError () returned 0xea [0043.595] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1d44*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1d44*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.595] CreateFileA (lpFileName="C:\\Users\\Public\\Desktop\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\desktop\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.596] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.596] SetEndOfFile (hFile=0xdc) returned 1 [0043.596] CloseHandle (hObject=0xdc) returned 1 [0043.596] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.596] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.596] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a53570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a53570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a53570, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7e9, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Adobe Reader X.lnk.crypt", cAlternateFileName="ADOBER~1.CRY")) returned 1 [0043.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a53570, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a53570, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a796d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a796d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a796d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a796d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8d1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Google Chrome.lnk.crypt", cAlternateFileName="GOOGLE~1.CRY")) returned 1 [0043.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b1f870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa79ebf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a796d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a796d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a796d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Mozilla Firefox.lnk.crypt", cAlternateFileName="MOZILL~1.CRY")) returned 1 [0043.596] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a796d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a796d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a796d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Mozilla Firefox.lnk.crypt", cAlternateFileName="MOZILL~1.CRY")) returned 0 [0043.596] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.596] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a796d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6a796d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a796d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x786f6665, dwReserved1=0x6b6e6c2e, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.596] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x786f6665, dwReserved1=0x6b6e6c2e, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0043.596] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.597] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.597] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.597] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.597] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.597] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1cec*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e1cec, pdwDataLen=0x18f8e0) returned 0 [0043.597] GetLastError () returned 0xea [0043.597] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1cec*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e1cec*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.597] CreateFileA (lpFileName="C:\\Users\\Public\\Documents\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\documents\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.597] WriteFile (in: hFile=0xdc, lpBuffer=0x33e2a60*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33e2a60*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.598] SetEndOfFile (hFile=0xdc) returned 1 [0043.598] CloseHandle (hObject=0xdc) returned 1 [0043.598] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.598] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.598] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.598] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.598] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6bf6490, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6bf6490, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6bf6490, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.598] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b1f870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa79ebf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.598] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x5a0000, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0043.598] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.599] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.599] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.599] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0043.599] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.599] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0738*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e0738, pdwDataLen=0x18f678) returned 0 [0043.599] GetLastError () returned 0xea [0043.599] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0738*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e0738*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.599] CreateFileA (lpFileName="C:\\Users\\Public\\Documents\\My Music\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\documents\\my music\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.601] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.602] SetEndOfFile (hFile=0xf8) returned 1 [0043.602] CloseHandle (hObject=0xf8) returned 1 [0043.602] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0043.602] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.602] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f60c, ftLastWriteTime.dwHighDateTime=0x18f608, nFileSizeHigh=0x18f650, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x90\x5c")) returned 0xffffffff [0043.602] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0043.602] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.603] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.603] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.603] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c91c0) returned 1 [0043.603] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.603] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1d58*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e1d58, pdwDataLen=0x18f678) returned 0 [0043.603] GetLastError () returned 0xea [0043.603] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e1d58*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e1d58*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.603] CreateFileA (lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\documents\\my pictures\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.605] WriteFile (in: hFile=0xf8, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.605] SetEndOfFile (hFile=0xf8) returned 1 [0043.606] CloseHandle (hObject=0xf8) returned 1 [0043.606] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.606] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.606] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f60c, ftLastWriteTime.dwHighDateTime=0x18f608, nFileSizeHigh=0x18f650, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x90\x5c")) returned 0xffffffff [0043.606] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0043.606] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.606] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.606] CryptHashData (hHash=0x5c91c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.606] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0043.606] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.607] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0750*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e0750, pdwDataLen=0x18f678) returned 0 [0043.607] GetLastError () returned 0xea [0043.607] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0750*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e0750*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.607] CreateFileA (lpFileName="C:\\Users\\Public\\Documents\\My Videos\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\documents\\my videos\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.609] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.611] SetEndOfFile (hFile=0xf8) returned 1 [0043.611] CloseHandle (hObject=0xf8) returned 1 [0043.611] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0043.611] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.611] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x21259c, ftCreationTime.dwLowDateTime=0x2125cc, ftCreationTime.dwHighDateTime=0x6603, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x18f60c, ftLastWriteTime.dwHighDateTime=0x18f608, nFileSizeHigh=0x18f650, nFileSizeLow=0x74ac89a0, dwReserved0=0x7d76f7c9, dwReserved1=0xfffffffe, cFileName="\xb3\x2f\xac\x74\xe0\x43\x41", cAlternateFileName="\xc0\x90\x5c")) returned 0xffffffff [0043.611] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x18e, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0043.611] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.611] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6bf6490, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6bf6490, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0043.611] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.612] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.612] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.612] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8f40) returned 1 [0043.612] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.612] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18f8e0) returned 0 [0043.612] GetLastError () returned 0xea [0043.612] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.612] CreateFileA (lpFileName="C:\\Users\\Public\\Downloads\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\downloads\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.613] WriteFile (in: hFile=0xdc, lpBuffer=0x33e2f90*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33e2f90*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.614] SetEndOfFile (hFile=0xdc) returned 1 [0043.614] CloseHandle (hObject=0xdc) returned 1 [0043.614] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0043.614] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.614] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa7c4d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0043.614] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa7c4d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.614] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6bf6490, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6bf6490, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6bf6490, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.614] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7c4d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa7c4d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.614] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7c4d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa7c4d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.614] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0043.614] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0043.614] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.615] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.615] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.615] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.615] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.615] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2880*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2880, pdwDataLen=0x18f8e0) returned 0 [0043.615] GetLastError () returned 0xea [0043.615] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2880*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2880*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.615] CreateFileA (lpFileName="C:\\Users\\Public\\Favorites\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\favorites\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.615] WriteFile (in: hFile=0xdc, lpBuffer=0x33e0a74*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33e0a74*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.615] SetEndOfFile (hFile=0xdc) returned 1 [0043.615] CloseHandle (hObject=0xdc) returned 1 [0043.616] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.616] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.616] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Favorites\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.616] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa9b1f870, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.616] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b1f870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.616] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b1f870, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa9b1f870, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 0 [0043.616] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.616] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa778a90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa778a90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa778a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.616] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6c1c5f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6c1c5f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2045524f, dwReserved1=0x52434e45, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0043.616] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.617] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.617] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.617] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8f40) returned 1 [0043.617] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.617] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0aac*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e0aac, pdwDataLen=0x18f8e0) returned 0 [0043.617] GetLastError () returned 0xea [0043.617] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0aac*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e0aac*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.617] CreateFileA (lpFileName="C:\\Users\\Public\\Libraries\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\libraries\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.617] WriteFile (in: hFile=0xdc, lpBuffer=0x217440*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x217440*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.618] SetEndOfFile (hFile=0xdc) returned 1 [0043.618] CloseHandle (hObject=0xdc) returned 1 [0043.618] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0043.619] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.619] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Libraries\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa7c4d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0043.619] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa7c4d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.619] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6bf6490, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6bf6490, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6c1c5f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x58, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.619] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7c4d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa7c4d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.619] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0043.619] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0043.619] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0043.619] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6c1c5f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6c1c5f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7262696c, dwReserved1=0x2d797261, cFileName="Music", cAlternateFileName="")) returned 1 [0043.619] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.619] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.620] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.620] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.620] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.620] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e06e0, pdwDataLen=0x18f8e0) returned 0 [0043.620] GetLastError () returned 0xea [0043.620] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e06e0*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e06e0*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.620] CreateFileA (lpFileName="C:\\Users\\Public\\Music\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\music\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.620] WriteFile (in: hFile=0xdc, lpBuffer=0x33e0ca4*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x33e0ca4*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.620] SetEndOfFile (hFile=0xdc) returned 1 [0043.620] CloseHandle (hObject=0xdc) returned 1 [0043.620] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.620] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.620] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa79ebf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa79ebf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0043.620] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa79ebf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa79ebf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.620] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6c1c5f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6c1c5f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6c1c5f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.621] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa79ebf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa79ebf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.621] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6c1c5f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6c1c5f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0043.621] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.621] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.621] CryptHashData (hHash=0x5c90c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.621] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c91c0) returned 1 [0043.621] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.621] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x31b0724*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x31b0724, pdwDataLen=0x18f678) returned 0 [0043.621] GetLastError () returned 0xea [0043.621] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.622] CreateFileA (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\music\\sample music\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.622] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.623] SetEndOfFile (hFile=0xf8) returned 1 [0043.623] CloseHandle (hObject=0xf8) returned 1 [0043.623] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.624] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.624] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xaa7c4d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.624] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xaa7c4d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.624] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6c1c5f0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6c1c5f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6c1c5f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.624] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7c4d50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa7c4d50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.624] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Kalimba.mp3", cAlternateFileName="")) returned 1 [0043.624] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be5ebf7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Maid with the Flaxen Hair.mp3", cAlternateFileName="MAIDWI~1.MP3")) returned 1 [0043.624] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 1 [0043.624] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 0 [0043.624] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.624] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa6c1c5f0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6c1c5f0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0043.624] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0043.624] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6c42750, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6c42750, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20455263, dwReserved1=0x52434e45, cFileName="Pictures", cAlternateFileName="")) returned 1 [0043.624] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.625] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.625] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.625] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c91c0) returned 1 [0043.625] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.625] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x30ff438*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x30ff438, pdwDataLen=0x18f8e0) returned 0 [0043.625] GetLastError () returned 0xea [0043.625] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x1ff8c28*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.625] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\pictures\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.625] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.625] SetEndOfFile (hFile=0xdc) returned 1 [0043.625] CloseHandle (hObject=0xdc) returned 1 [0043.625] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.625] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.625] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa79ebf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa79ebf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.626] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa79ebf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa79ebf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.626] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6c42750, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6c42750, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6c42750, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.626] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa79ebf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa79ebf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7c4d50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.626] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa71e9b90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa71e9b90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0043.626] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.626] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.626] CryptHashData (hHash=0x5c8f40, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.626] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c90c0) returned 1 [0043.626] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.626] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e0708, pdwDataLen=0x18f678) returned 0 [0043.626] GetLastError () returned 0xea [0043.626] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e0708*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e0708*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.627] CreateFileA (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\pictures\\sample pictures\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.627] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.628] SetEndOfFile (hFile=0xf8) returned 1 [0043.628] CloseHandle (hObject=0xf8) returned 1 [0043.628] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.628] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.628] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xaa7eaeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7eaeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.628] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xaa7eaeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7eaeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.628] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6c42750, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6c42750, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6d00e30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Chrysanthemum.jpg.crypt", cAlternateFileName="CHRYSA~1.CRY")) returned 1 [0043.628] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6d26f90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6d26f90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6dbf510, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Desert.jpg.crypt", cAlternateFileName="DESERT~1.CRY")) returned 1 [0043.628] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6de5670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6de5670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6de5670, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.628] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7eaeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa7eaeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7eaeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.628] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6de5670, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6de5670, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6e57a90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Hydrangeas.jpg.crypt", cAlternateFileName="HYDRAN~1.CRY")) returned 1 [0043.628] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6e7dbf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6e7dbf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6f16170, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Jellyfish.jpg.crypt", cAlternateFileName="JELLYF~1.CRY")) returned 1 [0043.629] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6f3c2d0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6f3c2d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6fd4850, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Koala.jpg.crypt", cAlternateFileName="KOALAJ~1.CRY")) returned 1 [0043.629] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6ffa9b0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa6ffa9b0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7092f30, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Lighthouse.jpg.crypt", cAlternateFileName="LIGHTH~1.CRY")) returned 1 [0043.629] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa70b9090, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa70b9090, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7151610, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Penguins.jpg.crypt", cAlternateFileName="PENGUI~1.CRY")) returned 1 [0043.629] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7151610, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7151610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa71e9b90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Tulips.jpg.crypt", cAlternateFileName="TULIPS~1.CRY")) returned 1 [0043.629] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7151610, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7151610, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa71e9b90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Tulips.jpg.crypt", cAlternateFileName="TULIPS~1.CRY")) returned 0 [0043.629] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.629] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa71e9b90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa71e9b90, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0043.629] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.629] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa720fcf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa720fcf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73657275, dwReserved1=0x52434e45, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1 [0043.629] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.629] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.629] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.629] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c90c0) returned 1 [0043.630] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.630] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e09a8*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e09a8, pdwDataLen=0x18f8e0) returned 0 [0043.630] GetLastError () returned 0xea [0043.630] CryptEncrypt (in: hKey=0x5c90c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e09a8*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e09a8*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.630] CreateFileA (lpFileName="C:\\Users\\Public\\Recorded TV\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\recorded tv\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.634] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.634] SetEndOfFile (hFile=0xdc) returned 1 [0043.635] CloseHandle (hObject=0xdc) returned 1 [0043.635] CryptDestroyKey (hKey=0x5c90c0) returned 1 [0043.635] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.635] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7eaeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7eaeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.635] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7eaeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7eaeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.635] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71e9b90, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa71e9b90, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa720fcf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.635] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7eaeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa7eaeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7eaeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.635] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa720fcf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa720fcf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 1 [0043.635] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.636] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.636] CryptHashData (hHash=0x5c91c0, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.636] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c91c0, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c8f40) returned 1 [0043.636] CryptDestroyHash (hHash=0x5c91c0) returned 1 [0043.636] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2fa8*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2fa8, pdwDataLen=0x18f678) returned 0 [0043.636] GetLastError () returned 0xea [0043.636] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2fa8*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2fa8*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.636] CreateFileA (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\recorded tv\\sample media\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.636] WriteFile (in: hFile=0xf8, lpBuffer=0x33b8a14*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8a14*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.637] SetEndOfFile (hFile=0xf8) returned 1 [0043.637] CloseHandle (hObject=0xf8) returned 1 [0043.637] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0043.637] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.637] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7eaeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7eaeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c8f40 [0043.638] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7eaeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7eaeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.638] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa720fcf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa720fcf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa720fcf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.638] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7eaeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa7eaeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7eaeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.638] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 1 [0043.638] FindNextFileA (in: hFindFile=0x5c8f40, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 0 [0043.638] FindClose (in: hFindFile=0x5c8f40 | out: hFindFile=0x5c8f40) returned 1 [0043.638] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa720fcf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa720fcf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 0 [0043.638] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.638] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa720fcf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa720fcf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20455261, dwReserved1=0x52434e45, cFileName="Videos", cAlternateFileName="")) returned 1 [0043.638] CryptAcquireContextA (in: phProv=0x18f8d4, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f8d4*=0x5d0e80) returned 1 [0043.639] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f88c | out: phHash=0x18f88c) returned 1 [0043.639] CryptHashData (hHash=0x5c90c0, pbData=0x2a7fec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.639] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c90c0, dwFlags=0x0, phKey=0x18f8d0 | out: phKey=0x18f8d0*=0x5c8f40) returned 1 [0043.639] CryptDestroyHash (hHash=0x5c90c0) returned 1 [0043.639] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2fa8*, pdwDataLen=0x18f8e0*=0x258, dwBufLen=0x258 | out: pbData=0x33e2fa8, pdwDataLen=0x18f8e0) returned 0 [0043.639] GetLastError () returned 0xea [0043.639] CryptEncrypt (in: hKey=0x5c8f40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2fa8*, pdwDataLen=0x18f8dc*=0x258, dwBufLen=0x260 | out: pbData=0x33e2fa8*, pdwDataLen=0x18f8dc*=0x260) returned 1 [0043.639] CreateFileA (lpFileName="C:\\Users\\Public\\Videos\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\videos\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0043.639] WriteFile (in: hFile=0xdc, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f660, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f660*=0x7a0, lpOverlapped=0x0) returned 1 [0043.639] SetEndOfFile (hFile=0xdc) returned 1 [0043.639] CloseHandle (hObject=0xdc) returned 1 [0043.639] CryptDestroyKey (hKey=0x5c8f40) returned 1 [0043.639] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.639] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa79ebf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa79ebf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c90c0 [0043.639] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa79ebf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa79ebf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.640] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa720fcf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa720fcf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa720fcf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.640] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa79ebf0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa79ebf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa7eaeb0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.640] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa7235e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7235e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0043.640] CryptAcquireContextA (in: phProv=0x18f66c, szContainer=0x0, szProvider="Microsoft Enhanced Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f66c*=0x5d0e80) returned 1 [0043.640] CryptCreateHash (in: hProv=0x5d0e80, Algid=0x8004, hKey=0x0, dwFlags=0x0, phHash=0x18f624 | out: phHash=0x18f624) returned 1 [0043.640] CryptHashData (hHash=0x5c8f40, pbData=0x200ffec, dwDataLen=0xe, dwFlags=0x0) returned 1 [0043.640] CryptDeriveKey (in: hProv=0x5d0e80, Algid=0x6603, hBaseData=0x5c8f40, dwFlags=0x0, phKey=0x18f668 | out: phKey=0x18f668*=0x5c91c0) returned 1 [0043.640] CryptDestroyHash (hHash=0x5c8f40) returned 1 [0043.640] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2068*, pdwDataLen=0x18f678*=0x258, dwBufLen=0x258 | out: pbData=0x33e2068, pdwDataLen=0x18f678) returned 0 [0043.640] GetLastError () returned 0xea [0043.640] CryptEncrypt (in: hKey=0x5c91c0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x33e2068*, pdwDataLen=0x18f674*=0x258, dwBufLen=0x260 | out: pbData=0x33e2068*, pdwDataLen=0x18f674*=0x260) returned 1 [0043.641] CreateFileA (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\HOW TO RESTORE ENCRYPTED FILES.TXT" (normalized: "c:\\users\\public\\videos\\sample videos\\how to restore encrypted files.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0043.642] WriteFile (in: hFile=0xf8, lpBuffer=0x1fe1468*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f3f8, lpOverlapped=0x0 | out: lpBuffer=0x1fe1468*, lpNumberOfBytesWritten=0x18f3f8*=0x7a0, lpOverlapped=0x0) returned 1 [0043.643] SetEndOfFile (hFile=0xf8) returned 1 [0043.643] CloseHandle (hObject=0xf8) returned 1 [0043.643] CryptDestroyKey (hKey=0x5c91c0) returned 1 [0043.643] CryptReleaseContext (hProv=0x5d0e80, dwFlags=0x0) returned 1 [0043.643] FindFirstFileA (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*.*", lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xaa811010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa811010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName=".", cAlternateFileName="")) returned 0x5c91c0 [0043.644] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xaa811010, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa811010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="..", cAlternateFileName="")) returned 1 [0043.644] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7235e50, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xa7235e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7235e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="desktop.ini.crypt", cAlternateFileName="DESKTO~1.CRY")) returned 1 [0043.644] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7eaeb0, ftCreationTime.dwHighDateTime=0x1d53e26, ftLastAccessTime.dwLowDateTime=0xaa7eaeb0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xaa811010, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="HOW TO RESTORE ENCRYPTED FILES.TXT", cAlternateFileName="HOWTOR~1.TXT")) returned 1 [0043.644] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 1 [0043.644] FindNextFileA (in: hFindFile=0x5c91c0, lpFindFileData=0x18f610 | out: lpFindFileData=0x18f610*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 0 [0043.644] FindClose (in: hFindFile=0x5c91c0 | out: hFindFile=0x5c91c0) returned 1 [0043.644] FindNextFileA (in: hFindFile=0x5c90c0, lpFindFileData=0x18f878 | out: lpFindFileData=0x18f878*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa7235e50, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa7235e50, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x5a0000, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0043.644] FindClose (in: hFindFile=0x5c90c0 | out: hFindFile=0x5c90c0) returned 1 [0043.644] FindNextFileA (in: hFindFile=0x5c9100, lpFindFileData=0x18fae0 | out: lpFindFileData=0x18fae0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa720fcf0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa720fcf0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20455261, dwReserved1=0x52434e45, cFileName="Videos", cAlternateFileName="")) returned 0 [0043.644] FindClose (in: hFindFile=0x5c9100 | out: hFindFile=0x5c9100) returned 1 [0043.644] FindNextFileA (in: hFindFile=0x5c8e80, lpFindFileData=0x18fd48 | out: lpFindFileData=0x18fd48*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa6a796d0, ftLastAccessTime.dwHighDateTime=0x1d53e26, ftLastWriteTime.dwLowDateTime=0xa6a796d0, ftLastWriteTime.dwHighDateTime=0x1d53e26, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3, dwReserved1=0x18e, cFileName="Public", cAlternateFileName="")) returned 0 [0043.644] FindClose (in: hFindFile=0x5c8e80 | out: hFindFile=0x5c8e80) returned 1 [0043.644] ShowWindow (hWnd=0x301c0, nCmdShow=5) returned 0 [0043.644] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.645] IsWindowVisible (hWnd=0x301c0) returned 0 [0043.645] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0043.645] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.645] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x46, wParam=0x0, lParam=0x18ff08) returned 0x0 [0043.645] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.645] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x46, wParam=0x0, lParam=0x18ff08) returned 0x0 [0043.646] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.647] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x86, wParam=0x0, lParam=0x301c0) returned 0x1 [0043.648] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.648] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x6, wParam=0x0, lParam=0x301c0) returned 0x0 [0043.649] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.649] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x46, wParam=0x0, lParam=0x18ff08) returned 0x0 [0043.649] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.649] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x46, wParam=0x0, lParam=0x18ff08) returned 0x0 [0043.649] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.649] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x86, wParam=0x0, lParam=0x401c4) returned 0x1 [0043.651] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.651] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x6, wParam=0x1, lParam=0x401c4) returned 0x0 [0043.651] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.651] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x8, wParam=0x301c0, lParam=0x0) returned 0x0 [0043.651] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.651] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0043.651] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.651] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0043.652] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.652] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0043.652] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.652] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0043.652] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.652] SetFocus (hWnd=0x401bc) returned 0x301c0 [0043.652] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.652] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x8, wParam=0x401bc, lParam=0x0) returned 0x0 [0043.652] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.652] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0043.652] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0043.652] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0043.652] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0043.653] IsWindowEnabled (hWnd=0x401bc) returned 1 [0043.653] SetFocus (hWnd=0x401bc) returned 0x401bc [0043.653] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x7, wParam=0x301c0, lParam=0x0) returned 0x0 [0043.653] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.653] SendMessageA (hWnd=0x401bc, Msg=0xbd35, wParam=0x4010842, lParam=0x401bc) returned 0x2e100750 [0043.653] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0043.653] SetTextColor (hdc=0x4010842, color=0x0) returned 0x0 [0043.653] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.653] SetBkMode (hdc=0x4010842, mode=2) returned 2 [0043.653] SetBkColor (hdc=0x4010842, color=0xf0f0f0) returned 0xffffff [0043.653] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.653] CreateSolidBrush (color=0xf0f0f0) returned 0x2e100750 [0043.657] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.657] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0043.663] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.663] SetBkMode (hdc=0x4010842, mode=2) returned 2 [0043.663] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.663] SetBkColor (hdc=0x4010842, color=0xf0f0f0) returned 0xffffff [0043.663] SetBrushOrgEx (in: hdc=0x4010842, x=0, y=0, lppt=0x0 | out: lppt=0x0) returned 1 [0043.663] GetClientRect (in: hWnd=0x301c0, lpRect=0x18fd34 | out: lpRect=0x18fd34) returned 1 [0043.663] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.663] FillRect (hDC=0x4010842, lprc=0x18fd34, hbr=0x2e100750) returned 1 [0043.663] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x14, wParam=0x4010842, lParam=0x0) returned 0x0 [0043.663] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0043.663] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0043.664] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0043.664] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0x14, wParam=0x430107b5, lParam=0x0) returned 0x1 [0043.664] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.664] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x47, wParam=0x0, lParam=0x18ff08) returned 0x0 [0043.664] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.664] GetWindowRect (in: hWnd=0x301c0, lpRect=0x18fd4c | out: lpRect=0x18fd4c) returned 1 [0043.664] GetWindowRect (in: hWnd=0x401c4, lpRect=0x18fd48 | out: lpRect=0x18fd48) returned 1 [0043.664] GetWindowRect (in: hWnd=0x401c4, lpRect=0x18fd2c | out: lpRect=0x18fd2c) returned 1 [0043.664] SetWindowPos (hWnd=0x401c4, hWndInsertAfter=0x0, X=0, Y=0, cx=593, cy=0, uFlags=0x14) returned 1 [0043.664] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.664] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x46, wParam=0x0, lParam=0x18fcd8) returned 0x0 [0043.665] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.665] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x83, wParam=0x1, lParam=0x18fcb0) returned 0x0 [0043.665] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.665] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x47, wParam=0x0, lParam=0x18fcd8) returned 0x0 [0043.665] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.665] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x5, wParam=0x0, lParam=0x24b) returned 0x0 [0043.665] GetClientRect (in: hWnd=0x401c4, lpRect=0x18f8b4 | out: lpRect=0x18f8b4) returned 1 [0043.665] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x5, wParam=0x0, lParam=0x1d30241) returned 0x0 [0043.665] GetClientRect (in: hWnd=0x301c0, lpRect=0x18fd64 | out: lpRect=0x18fd64) returned 1 [0043.665] IsWindowVisible (hWnd=0x301c0) returned 1 [0043.665] IsWindowVisible (hWnd=0x301c0) returned 1 [0043.665] IsWindowVisible (hWnd=0x301c0) returned 1 [0043.665] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.665] GetWindowRect (in: hWnd=0x301c0, lpRect=0x18fd4c | out: lpRect=0x18fd4c) returned 1 [0043.665] GetWindowRect (in: hWnd=0x301c0, lpRect=0x18fd48 | out: lpRect=0x18fd48) returned 1 [0043.665] GetWindowRect (in: hWnd=0x401c4, lpRect=0x18fd38 | out: lpRect=0x18fd38) returned 1 [0043.665] GetWindowRect (in: hWnd=0x401c4, lpRect=0x18fd1c | out: lpRect=0x18fd1c) returned 1 [0043.665] GetWindowRect (in: hWnd=0x401c4, lpRect=0x18fd34 | out: lpRect=0x18fd34) returned 1 [0043.665] GetWindowRect (in: hWnd=0x401c4, lpRect=0x18fd1c | out: lpRect=0x18fd1c) returned 1 [0043.665] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x3, wParam=0x0, lParam=0x1e0008) returned 0x0 [0043.665] GetClientRect (in: hWnd=0x401c4, lpRect=0x18ff24 | out: lpRect=0x18ff24) returned 1 [0043.665] GetClientRect (in: hWnd=0x301c0, lpRect=0x18ff24 | out: lpRect=0x18ff24) returned 1 [0043.666] IsWindowVisible (hWnd=0x301c0) returned 1 [0043.666] IsWindowVisible (hWnd=0x301c0) returned 1 [0043.666] IsWindowVisible (hWnd=0x301c0) returned 1 [0043.666] ShowWindow (hWnd=0x401c4, nCmdShow=5) returned 1 [0043.666] GetClientRect (in: hWnd=0x401c4, lpRect=0x18ff30 | out: lpRect=0x18ff30) returned 1 [0043.666] WaitMessage () returned 1 [0043.666] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0043.666] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.666] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x201c5 [0043.667] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.667] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x201c3 [0043.668] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0043.668] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0043.668] TranslateMessage (lpMsg=0x18ff34) returned 0 [0043.668] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0043.668] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0043.668] TranslateMessage (lpMsg=0x18ff34) returned 0 [0043.668] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0043.668] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0043.668] TranslateMessage (lpMsg=0x18ff34) returned 0 [0043.668] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0043.668] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0043.668] TranslateMessage (lpMsg=0x18ff34) returned 0 [0043.668] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0043.668] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0043.668] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.668] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x84, wParam=0x0, lParam=0xd20105) returned 0x1 [0043.668] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.668] GetCapture () returned 0x0 [0043.668] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x20, wParam=0x301c0, lParam=0x2000001) returned 0x0 [0043.669] TranslateMessage (lpMsg=0x18ff34) returned 0 [0043.669] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0043.669] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.669] GetKeyState (nVirtKey=18) returned 0 [0043.669] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x200, wParam=0x0, lParam=0xb400fd) returned 0x0 [0043.669] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0043.669] TranslateMessage (lpMsg=0x18ff34) returned 0 [0043.669] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0043.669] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.669] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1e040862 [0043.669] GetUpdateRgn (hWnd=0x301c0, hRgn=0x1e040862, bErase=0) returned 2 [0043.669] BeginPaint (in: hWnd=0x301c0, lpPaint=0x18fc90 | out: lpPaint=0x18fc90) returned 0x1010851 [0043.669] EndPaint (hWnd=0x301c0, lpPaint=0x18fc90) returned 1 [0043.670] DeleteObject (ho=0x1e040862) returned 1 [0043.670] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0043.670] TranslateMessage (lpMsg=0x18ff34) returned 0 [0043.670] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0043.670] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0043.670] CallWindowProcA (lpPrevWndFunc=0x771aabd3, hWnd=0x401bc, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x0 [0043.670] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0043.670] SendMessageA (hWnd=0x401bc, Msg=0xbd35, wParam=0x4010842, lParam=0x401bc) returned 0x2e100750 [0043.670] GetPropA (hWnd=0x401bc, lpString="SELF_") returned 0x211434 [0043.670] SetTextColor (hdc=0x4010842, color=0x0) returned 0x0 [0043.670] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.670] SetBkMode (hdc=0x4010842, mode=2) returned 2 [0043.670] SetBkColor (hdc=0x4010842, color=0xf0f0f0) returned 0xffffff [0043.670] GetSysColor (nIndex=15) returned 0xf0f0f0 [0043.670] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0043.671] WaitMessage () returned 1 [0043.956] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0043.956] TranslateMessage (lpMsg=0x18ff34) returned 0 [0043.956] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0043.956] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0043.956] WaitMessage () returned 1 [0045.859] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0045.860] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0045.860] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x84, wParam=0x0, lParam=0x51020a) returned 0x1 [0045.860] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0045.860] GetCapture () returned 0x0 [0045.860] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x20, wParam=0x301c0, lParam=0x2000001) returned 0x0 [0045.860] TranslateMessage (lpMsg=0x18ff34) returned 0 [0045.860] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0045.860] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0045.860] GetKeyState (nVirtKey=18) returned 0 [0045.860] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x200, wParam=0x0, lParam=0x330202) returned 0x0 [0045.860] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0045.860] WaitMessage () returned 1 [0048.142] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0048.142] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0048.142] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0048.142] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0048.142] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0048.142] WaitMessage () returned 1 [0068.895] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0068.896] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0068.896] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0068.896] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0068.896] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0068.896] WaitMessage () returned 1 [0106.029] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0106.029] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0106.030] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x84, wParam=0x0, lParam=0x1d10108) returned 0x1 [0106.030] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0106.030] GetCapture () returned 0x0 [0106.030] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x20, wParam=0x301c0, lParam=0x2000001) returned 0x0 [0106.030] TranslateMessage (lpMsg=0x18ff34) returned 0 [0106.030] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0106.030] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0106.030] GetKeyState (nVirtKey=18) returned 0 [0106.030] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x200, wParam=0x0, lParam=0x1b30100) returned 0x0 [0106.030] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0106.030] WaitMessage () returned 1 [0146.818] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0146.818] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0146.819] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x201c3 [0146.819] GetPropA (hWnd=0x401c4, lpString="SELF_") returned 0x210394 [0146.819] NtdllDefWindowProc_A (hWnd=0x401c4, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0146.819] WaitMessage () returned 1 [0237.193] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0237.194] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0237.195] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x84, wParam=0x0, lParam=0x16101bc) returned 0x1 [0237.195] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0237.195] GetCapture () returned 0x0 [0237.195] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x20, wParam=0x301c0, lParam=0x2000001) returned 0x0 [0237.195] TranslateMessage (lpMsg=0x18ff34) returned 0 [0237.195] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0237.195] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0237.195] GetKeyState (nVirtKey=18) returned 0 [0237.195] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x200, wParam=0x0, lParam=0x14301b4) returned 0x0 [0237.195] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0237.195] WaitMessage () returned 1 [0257.349] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0257.349] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0257.350] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x84, wParam=0x0, lParam=0x460098) returned 0x1 [0257.350] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0257.350] GetCapture () returned 0x0 [0257.350] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x20, wParam=0x301c0, lParam=0x2000001) returned 0x0 [0257.350] TranslateMessage (lpMsg=0x18ff34) returned 0 [0257.350] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0257.350] GetPropA (hWnd=0x301c0, lpString="SELF_") returned 0x2109e4 [0257.350] GetKeyState (nVirtKey=18) returned 0 [0257.350] NtdllDefWindowProc_A (hWnd=0x301c0, Msg=0x200, wParam=0x0, lParam=0x280090) returned 0x0 [0257.350] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0257.350] WaitMessage () Thread: id = 2 os_tid = 0xaa4